Amnesia ransomware - How to remove

Amnesia is a ransomware virus that functions like most of the crypto-viruses around. The name Amnesia refers to not only one virus, but a specific family of this style of infections. A related sample is called CryptoBoss and it is a posterior variant but is structured similarly to its preceder. Additionally, there is a list of different extensions that samples of this branch can affix to encrypted executables. The following extensions are all that this family has been determined to proceed with: .01, .02, .amnesia, .[[email protected]].LOCKED, .CRYPTOBOSS, .[[email protected]].SON and .@decrypt_2017. These extensions are to stand as indicators which ransomware sample has carried out a fruitful attack. Providentially, researchers from Emsisoft have already fortuitously introduced a decryptor for the victims. Click here to download the file-recovery software.

Technicalities of this crypto-virus

To start off this part of the analysis, we should indicate that Amnesia ransomware managed to reach a record: it targets 7763 file types and manages to encrypt them! Security researchers are explaining that no other variant has ever been programmed to aim at such a high number of files. Additionally, this variant should be assigned to the category of ransomware infections that are written in Delphi programming language, meaning that it is not a sophisticated virus. Probably that is why researchers have already produced a cure for it.

This money-demanding infection has been determined to encrypt files with the help from AES-256 cipher which is a very commonly-selected algorithm. To perplex this situation even further, infection will launch a command, ending in a total destruction of Shadow Volume Copies. Individual operating systems will be dissociated from one another by giving them distinct ID numbers. They contain a bunch of different numbers and are longer that usual.

However, some confusion arose when this infection was first detected. It has copied several aspects from Globe ransomware, but it was soon discovered that Amnesia was a separate virus. In some of its variants, it demands users to contact [email protected] or [email protected] email addresses.

Researchers have also distinguished a couple of possible payloads of this infection: Happier.exe bstarb.exe, guide.exe, files could be the source of malicious activities in operating systems. Another feature that was noticed: a total transformation of names of files that have influenced by encryption. Instead of regular filenames, executables will be rebranded. After this radical change, regular names will be replaced with random sequences of letters and numbers.

Furthermore, a sample which was detected a week ago, pretended to be a CTB-Locker. While the primary variant placed HOW the TO the RECOVER The ENCRYPTED files.txt as the ransom note, samples that followed offered other executables: the RECOVER-FILES.HTML or __ P_R_O_CH_T_I__CTB-Locker__PROChTI__PROChTI.TXT.

No need to pay the ransom: recover files for free

Emsisoft has released a decrypter for this variant and it is available completely free of charge. Instructions about how a tool for file recovery should be used is explained in the official website of Emsisoft. If you have any questions, you can either contact them or leave a comment below and we will try to help you as well. Since this infection has been solved, there is no need to even consider paying the ransom. The exact fee for decryption is not mentioned in any of the ransom notes. We presume that this information is to be provided via email letters.

How does ransomware spread?

Malicious payloads could be transmitted via spam campaigns. In messages that originate from unreliable sources, users will be recommended to download specific attachments or follow links into websites of some sort. However, this is not a good idea because people could download Trojan infections instead of the files that were promised. By entering harmful websites, you could secretively install a ransomware infection or other variant of malware, like a browser hijacker.

Spyhunter or Malwarebytes are the tools that will assist you with the removal of Amnesia ransomware virus. Additionally, they will protect you from malware in the future.

Update of the 5th of June, 2017. Amnesia 2 has been recently detected. It adds .TRMT extension to the encrypted digital files. Also, a HOW TO RECOVER ENCRYPTED FILES.TXT executable is inserted. Thankfully, this variant is decryptable. All you have to do is download the software for decryption.

How to recover Amnesia ransomware encrypted files and remove the virus

Step 1. Restore system into last known good state using system restore

1. Reboot your computer to Safe Mode with Command Prompt:

for Windows 7 / Vista/ XP

• Start → Shutdown → Restart → OK.
• Press F8 key repeatedly until Advanced Boot Options window appears.
• Choose Safe Mode with Command Prompt.

for Windows 8 / 10

• Press Power at Windows login screen. Then press and hold Shift key and click Restart.
• Choose Troubleshoot → Advanced Options → Startup Settings and click Restart.
• When it loads, select Enable Safe Mode with Command Prompt from the list of Startup Settings.

 

2.Restore System files and settings.

• When Command Prompt mode loads, enter cd restore and press Enter.
• Then enter rstrui.exe and press Enter again.
• Click “Next” in the windows that appeared.
• Select one of the Restore Points that are available before CryptoBoss ransomware virus has infiltrated to your system and then click “Next”.
• To start System restore click “Yes”.

 

Step 2. Complete removal of Amnesia virus

After restoring your system, it is recommended to scan your computer with an anti-malware program, like Spyhunter and remove all malicious files related to Amnesia ransomware. You can check other tools here.  

Step 3. Restore CryptoBoss ransomware virus affected files using Shadow Volume Copies

If you do not use System Restore option on your operating system, there is a chance to use shadow copy snapshots. They store copies of your files that point of time when the system restore snapshot was created. Usually Amnesia virus tries to delete all possible Shadow Volume Copies, so this methods may not work on all computers. However, it may fail to do so. Shadow Volume Copies are only available with Windows XP Service Pack 2, Windows Vista, Windows 7, and Windows 8. There are two ways to retrieve your files via Shadow Volume Copy. You can do it using native Windows Previous Versions or via Shadow Explorer. a) Native Windows Previous Versions Right-click on an encrypted file and select Properties → Previous versions tab. Now you will see all available copies of that particular file and the time when it was stored in a Shadow Volume Copy. Choose the version of the file you want to retrieve and click Copy if you want to save it to some directory of your own, or Restore if you want to replace existing, encrypted file. If you want to see the content of file first, just click Open.

b) Shadow Explorer It is a program that can be found online for free. You can download either a full or a portable version of Shadow Explorer. Open the program. On the left top corner select the drive where the file you are looking for is a stored. You will see all folders on that drive. To retrieve a whole folder, right-click on it and select “Export”. Then choose where you want it to be stored.

Step 4. Use Data Recovery programs to recover Amnesia ransomware encrypted files

There are several data recovery programs that might recover encrypted files as well. This does not work in all cases but you can try this:

• We suggest using another PC and connect the infected hard drive as slave. It is still possible to do this on infected PC though.
• Download a data recovery program.
• Install and scan for recently deleted files.

Note: In many cases it is impossible to restore data files affected by modern ransomware. Thus I recommend using decent cloud backup software as precaution. We recommend checking out Carbonite, BackBlaze, CrashPlan or Mozy Home.