How to remove Aesir ransomware and decrypt .aesir files

What is Aesir Ransomware

Aesir Ransomware is another crypto-virus in the generation of Locky ransomware family. Virus uses RSA-2048 and AES-128 encryption algorithms. Aesir detects and encrypts more then 450 file types, and most sensitive are user documents, pictures and videos. Now it appends .aesir extension and has some minor technical changes in comparison to previous versions. This crypto-virus renames files with complex and random 24-character alphanumeric code separated by dashes. Ransom amount is huge: 3 BitCoins (~$2200) and there is no earthly use to pay it. Malefactors, who created this malware never send decryption keys. Aesir modifies desktop background with an image that contains information about the infection and instructions for user to pay. Payment is organized via Tor networks and Bitcoin wallets, which makes hackers untraceable. Ransomware creates 3 files (-INSTRUCTION.bmp, _1-INSTRUCTION.html and -INSTRUCTION.html) and copies them to the folder with encrypted files. BMP image is used as new desktop background, two other contain the same information in HTML or text format. Use this tutorial to remove Aesir ransomware and decrypt .aesir files in Windows 10, 8, 7, XP.

Note: Hackers usually do not send any decryptors or decryption keys even if you pay them. Wait until working decryptor appears or try to restore .aesir files manually from backup or using instructions below.

How Aesir Ransomware infected your PC

Aesir like Locky or Thor uses spam e-mails with malicious attachments, with various types of files (.zip, .docm, .xlsx, .csv). Infection is realized via archived java-script files or built-in macros inside the Word document, that will then download main executable. JavaScript files icons may look like text files and unsuspecting users usually click on them. Virus assigns certain ID with the victims, that is used to name those files and supposedly to send decryption key. In order to prevent infection with this type of threats in future we recommend you to use SpyHunter 5 and HitmanPro with Cryptoguard.

Download Aesir Ransomware Removal Tool

To remove Aesir Ransomware completely we recommend you to use SpyHunter 5 from EnigmaSoft Limited. It detects and removes all files, folders and registry keys of Aesir Ransomware.

Alternative remover

As a good free alternative to remove Aesir Ransomware use Malwarebytes Anti-Malware. It will detect core files and processes of Aesir ransomware and eliminate them to allow you start decryption of your files.

How to remove Aesir Ransomware manually

It is not recommended to remove Aesir Ransomware manually, for safer solution use Removal Tools instead.

Aesir Ransomware files:


-INSTRUCTION.bmp
_1-INSTRUCTION.html
-INSTRUCTION.html


Aesir Ransomware registry keys:


no information


How to decrypt and restore .aesir files

Use automated decryptors

Aesir Ransomware allows user to decrypt 1 file for free. This can be used to attempt and decrypt all files by determining encryption key using this decrypted file and comparing it with encrypted one using special tools. Ransomware decryptor from Kaspersky may be useful in this case. It is free and easy to use. Download Kaspersky Ransomware Decryptor here:

There is no purpose to pay the ransom, because there is no guarantee you will receive the key, but you will put your bank credentials at risk.

If you are infected with Aesir ransomware and removed it from your computer you can try to decrypt your files. Antivirus vendors and individuals create free decryptors for some crypto-lockers. To attempt to decrypt them manually you can do the following:

Using Windows Previous Versions option:

1. Right-click on infected file and choose Properties.
2. Select Previous Versions tab.
3. Choose particular version of the file and click Copy.
4. To restore the selected file and replace the existing one, click on the Restore button.
5. In case there is no items in the list choose alternative method.

Using Shadow Explorer:

1. Download Shadow Explorer program.
2. Run it and you will see screen listing of all the drives and the dates that shadow copy was created.
3. Select the drive and date that you want to restore from.
4. Right-click on a folder name and select Export.
5. In case there are no other dates in the list, choose alternative method.

If you are using Dropbox:

1. Login to the DropBox website and go to the folder that contains encrypted files.
2. Right-click on the encrypted file and select Previous Versions.
3. Select the version of the file you wish to restore and click on the Restore button.

How to protect computer from viruses like Aesir Ransomware in future

Use Malwarebytes Anti-Ransomware Beta

Famous anti-malware vendor Malwarebytes along with EasySync Solutions created tool that will help you with active anti-ransomware protection as additional shield to your current protection.

Use HitmanPro.Alert with CryptoGuard

Dutch vendor of legendary cloud-based scanner HitmanPro – SurfRight released active antivirus solution HitmanPro.Alert with CryptoGuard feature that effectively protects from latest versions of cryptoviruses.