Amnesia 2 Ransomware

Amnesia 2 Ransomware is a slightly modified version of Amnesia Ransomware discovered by specialists working at pcthreat.com some time ago. To be frank, this new version does not differ much from the previous version the way it acts. That is, it also finds where users’ files are located and then encrypts them after the successful infiltration. You might wonder why it does that, but the answer is obvious – it tries to obtain money from users. Because it is its main goal, it has been put in the category of ransomware infections. Users who encounter this infection believe that the only way to get rid of it is paying the money required; however, it is one of the worst decisions users can make, according to specialists. Experienced researchers say that users should not pay a cent to cyber criminals because there are no guarantees that files will be decrypted when cyber criminals receive a payment and, on top of that, a decryptor that can unlock files for free has already been developed by specialists. Before you use it, you need to fully remove Amnesia 2 Ransomware from your computer. It is necessary to erase it first because it might encrypt the decryption tool as well. You will find more information about its removal in this article.

Like the first version of Amnesia Ransomware, Amnesia 2 Ransomware also illegally enters computers – there are two main distribution strategies used to distribute ransomware infections. After the successful entrance, it finds users’ pictures, documents, text files, and media files. Then, it encrypts them all by appending a new extension .01 or .02. Also, it changes files’ names to random alphanumeric characters, for example, 3w000000002-HXHJsGRWVDQfY8noDv79.02. Because of this, you will soon find out that your files have been encrypted. The information about the decryption of files is available in RECOVER-FILES.html – Amnesia 2 Ransomware creates this file in all directories containing encrypted files. If you have opened and read it, you should already know that you need to pay 0.5 Bitcoin (~1400 USD) to get files unlocked. Only two days are given to users to send a payment. Paying money is a very bad idea even though it might seem that it is the quickest solution to the problem, specialists say. The explanation why it is so is very simple – you might be left without your files and your money. Also, cyber criminals will never stop developing malicious applications if they get what they want. Therefore, our advice for you would be to remove fully a ransomware infection from your PC and then recover files using alternative data recovery methods. For example, you could recover files from a backup or use a free decryption key (you will need to download it first).

We cannot say anything new about the distribution of Amnesia 2 Ransomware because two popular ransomware distribution methods are used to promote it. That is, it might travel in spam emails as an attachment, or it might be spread via RDP brute-force attacks. Those two distribution strategies are adopted not without reason – a ransomware infection can enter PCs unnoticed. Since Amnesia 2 Ransomware is not the only existing ransomware infection, you might encounter a new crypto-threat one day too. In other words, you might lose your files again if you do not do anything to protect your computer. What we expect users to do is to install a security application. It is a tool that can help to avoid all kinds of malicious applications, so it must be enabled on users’ computers at all times, according to security experts.

Although Amnesia 2 Ransomware encrypts files, it does not make any other modifications on computers, so it should not be hard to remove it from the system. There is only one removal step you need to take – find and erase malicious files from the system. If it happens that you cannot find them anywhere, we suggest performing a full system scan with a reputable antimalware tool. When you delete this ransomware infection fully, you could decrypt files it has locked. All you need to do is to download a free decryptor from the web and then launch it. You will get your files decrypted in no time. As mentioned above, files can be recovered from a backup too – only those users who back up their files periodically could do that.

How to remove Amnesia 2 Ransomware

1. Open the Windows Explorer (tap Win+E).
2. Find suspicious recently downloaded files (check %TEMP%, %APPDATA%, %USERPROFILE%\Desktop, and %USERPROFILE%\Downloads directories).
3. Remove them all and then empty the Trash bin.