How to remove Willow Ransomware and recover files

Easy tips to delete Willow Ransomware and decrypt data

Willow Ransomware encrypts stored files, appends the .willow extension to their filenames. For example, it renames 1.jpg to “1.jpg.willow”, “2.jpg” to “2.jpg.willow”, and so on. It also changes the desktop wallpaper and creates READMEPLEASE.txt text file.

The text file contains payment information. It instructs victims to pay $500 or 0.1473766 BTC (Bitcoin) to the provided BTC wallet to get the unique decryption tool from the crooks behind the infection. Also, it warns them that if they do not pay the ransom, they will lose their files.

Most ransomware variants encrypt files using strong cipher algorithms. Therefore, victims cannot access the files without using a unique decryption key that they can purchase from the crooks behind the infection.

But, the problem is that these people often do not provide the decryption tool even if all their demands are met. In other word, they just scam the users – just disappear, leaving their files unencrypted, once the payment is received.

Thus, it is advised not to contact/ pay to the crooks and think of some alternatives for the files recovery. The best option for the files recovery is to use existing backups. But, not all users have the backups of the encrypted files available.

In this case, Shadow Copies and data recovery tools are the possible data recovery options they have. Check below the post in the data recovery section for the steps of using the above options to recover the files,

But, before that, remove Willow Ransomware from the system. The removal is necessary to prevent it from further files encryption and avoid malware spread on the network. Use some reputable antivirus tool and run a full system scan to remove the ransomware from the system.

How did Willow Ransomware enter my system?

Users infect their systems with ransomware through malicious emails, software cracking tools, files downloaded from unreliable sources, fake updaters and Trojans. Emails used to distribute malware contain malicious attachments/ files, if clicked- the infection is triggered.

Software cracking tools are supposed to bypass software activation/ registration. They are used to avoid paying for software. These tools often contain malware. Files downloaded from unreliable sources infect systems when users execute them.

Fake software updaters infect systems by injecting malware instead of fixes, updates or exploiting outdated software vulnerabilities. Trojans can be used to distribute malware too. Usually, they are disguised as legit programs. Once a computer is injected with Trojan, it drops its payload.

Text presented in Willow Ransomware’s ransom note (“READMEPLEASE.txt”):

Hello lad. I, Willow Wolf, encrypted your files yet again.

But as I’m good now, I done it because I think you are an threat to The Silver Paw

and The Safe Place. Most of your files are encrypted.

Pay me $500 in some way. If not – I’m sorry, you’ll lose your files, and any

decryptor key is totally useless.

Payment information:

Amount: 0.1473766 BTC

Bitcoin Address:  e3i4h893h934-WillowWolf3983289210

How to prevent ransomware infection?

Installed programs should never be updated or activated using unofficial, third party tools. It must be achieved using tools provided by official developers. Attachments and links in irrelevant emails sent from unknown, suspicious addresses should never be opened as well.

Software, files should have to be downloaded from official pages. The operating system should have to be scanned for malware and other threats regularly. It is recommended to run these scans using some reputable antivirus tool.

If the system is already infected, we recommend you use some reputable antivirus tool to remove it automatically from the system. The manual removal is also possible (the manual steps are provided below), but we do not recommended it you to use if you do not have advanced computer skill.

Antimalware Details And User Guide

Click Here For Windows

Click Here For Mac

Step 1: Remove Willow Ransomware through “Safe Mode with Networking”

Step 2: Delete Willow Ransomware using “System Restore”

Step 1: Remove Willow Ransomware through “Safe Mode with Networking”

For Windows XP and Windows 7 users: Boot the PC in “Safe Mode”. Click on “Start” option and continuously press on F8 during the start process until the “Windows Advanced Option” menu appears on the screen. Choose “Safe Mode with Networking” from the list.

Now, a windows homescreen appears on the desktop and work-station is now working on “Safe mode with networking”.

For Windows 8 Users: Go to the “Start Screen”. In the search results select settings, type “Advanced”. In the “General PC Settings” option, choose “Advanced startup” option. Again, click on the “Restart Now” option. The work-station boots to “Advanced Startup Option Menu”. Press on “Troubleshoot” and then “Advanced options” button.  In the “Advanced Option Screen”, press on “Startup Settings”. Again, click on “Restart” button. The work-station will now restart in to the “Startup Setting” screen. Next is to press F5 to boot in Safe Mode in Networking.

For Windows 10 Users: Press on Windows logo and on the “Power” icon. In the newly opened menu, choose “Restart” while continuously holding “Shift” button on the keyboard. In the new open “Choose an option” window, click on “Troubleshoot” and then on the “Advanced Options”. Select “Startup Settings” and press on “Restart”. In the next window, click on “F5” button on the key-board.

Step 2: Delete Willow Ransomware using “System Restore”

Log-in to the account infected with Willow Ransomware. Open the browser and download a legitimate anti-malware tool. Do a full System scanning. Remove all the malicious detected entries.

In case if you cannot start the PC in “Safe Mode with Networking”, Try using “System Restore”

• During the “Startup”, continuously press on F8 key until the “Advanced Option” menu appears. From the list, choose “Safe Mode with Command Prompt” and then press “Enter”

• In the new opened command prompt, enter “cd restore” and then press “Enter”.

• Type: rstrui.exe and Press “ENTER”

• Click “Next” on the new windows

• Choose any of the “Restore Points” and click on “Next”. (This step will restore the work-station to its earlier time and date prior to Willow Ransomware infiltration in the PC.

• In the newly opened windows, press on “Yes”.

Once your PC gets restored to its previous date and time, download the recommended anti-malware tool and perform a deep scanning in order to remove Willow Ransomware files if they left in the work-station.

In order to restore the each (separate) file by this ransomware, use “Windows Previous Version” feature. This method is effective when “System Restore Function” is enabled in the work-station.

Important Note: Some variants of Willow Ransomware delete the “Shadow Volume Copies” as well hence this feature may not work all the time and is applicable for selective computers only.

How to Restore Individual Encrypted File:

In order to restore a single file, right click on it and go to “Properties”. Select “Previous Version” tab. Select a “Restore Point” and click on “Restore” option.

In order to access the files encrypted by Willow Ransomware, you can also try using “Shadow Explorer”. In order to get more information on this application, press here.

Important: Data Encryption Ransomware are highly dangerous and it is always better that you take precautions to avoid its attack on your work-station. It is advised to use a powerful anti-malware tool in order to get protection in real-time. With this help of “SpyHunter”, “group policy objects” are implanted in the registries in order to block harmful infections like Willow Ransomware.

Also, In Windows 10, you get a very unique feature called “Fall Creators Update” that offer “Controlled Folder Access” feature in order to block any kind of encryption to the files. With the help of this feature, any files stored in the locations such as “Documents”, “Pictures”, “Music”, “Videos”, “Favorites” and “Desktop” folders are safe by default.

It is very important that you install this “Windows 10 Fall Creators Update” in your PC to protect your important files and data from ransomware encryption. The more information on how to get this update and add an additional protection form rnasomware attack has been discussed here.

How to Recover the Files Encrypted by Willow Ransomware?

Till now, you would have understood that what had happed to your personal files that got encrypted and how you can remove the scripts and payloads associated with Willow Ransomware in order to protect your personal files that has not been damaged or encrypted until now. In order to retrieve the locked files, the depth information related to “System Restore” and “Shadow Volume Copies” has already been discussed earlier. However, in case if you are still unable to access the encrypted files then you can try using a data recovery tool.

Use of Data Recovery Tool

This step is for all those victims who have already tries all the above mentioned process but didn’t find any solution. Also it is important that you are able to access the PC and can install any software. The data recovery tool works on the basis of System scanning and recovery algorithm. It searches the System partitions in order to locate the original files which were deleted, corrupted or damaged by the malware. Remember that you must not re-install the Windows OS otherwise the “previous” copies will get deleted permanently. You have to clean the work-station at first and remove Willow Ransomware infection. Leave the locked files as it is and follow the steps mentioned below.

Step1: Download the software in the work-station by clicking on the “Download” button below.

Step2: Execute the installer by clicking on downloaded files.

Step3: A license agreement page appears on the screen. Click on “Accept” to agree with its terms and use. Follow the on-screen instruction as mentioned and click on “Finish” button.

Step4: Once the installation gets completed, the program gets executed automatically. In the newly opened interface, select the file types that you want to recover and click on “Next”.

Step5: You can select the “Drives” on which you want the software to run and execute the recovery process. Next is to click on the “Scan” button.

Step6: Based on drive you select for scanning, the restore process begins. The whole process may take time depending on the volume of the selected drive and number of files. Once the process gets completed, a data explorer appears on the screen with preview of that data that is to be recovered. Select the files that you want to restore.

Step7. Next is to locate the location where you want to saver the recovered files.