Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Amnesia Ransomware


  • This topic is locked This topic is locked
3 replies to this topic

#1 Tony_Ya

Tony_Ya

  • Members
  • 8 posts
  • OFFLINE
  •  
  • Local time:07:52 PM

Posted 09 May 2017 - 05:25 AM

Hi there, have a system at work that has picked up a ransomware app that has encrypted flies with .amnesia extension.
 
Anyone seen this before. There is a note "HOW TO RECOVER ENCRYPTED FILES.TXT" in every folder that has been hit.
 
No luck identifying with the online tool, can anyone help?
 
Contents of ransom demand follow - 

 
====================================================================================================
                         ____     _        _____    _____     ____     _
                        /  __|_  / |____  / ___ \  |  ___\   / __ \   / |____
                        \_____/  \_____/  \_____/  |_____/  /______\  \_____/
 
                          ______  ______  __  __  _____  _____  _____  ______
                         / _   / /     / /  \/ / /  __/ /  __/ /  __/ / _   /
                        /     / /     / /     / /  _/  /__  / _/ /_  /     /
                        \_/__/  \/_/_/  \/\__/  \___/  \___/  \___/  \_/__/
 
====================================================================================================
 
All your files have been encrypted!
 
Your personal ID
0949166271403440305965019842199807897787951258439672810685101799895678662137172791807958389287316026
6288468734013045164153041059677543340333214559414482998003076296817781475890971599598589643348303711
8147670633187315872051110082131412437684734983115225244594440494667728498810256215265141109346410435
3648319107165617316009418542136570729076770140178812809803890541539432327146495045474262677692564222
5288597681450880744535925396047986546705559801934035418832988795312150127942631659903124058434847844
6719636425793650500626834304765101948909985531724266441342541075630856738799817947240304690057274579
403854721930717986
 
All your files have been encrypted due to a security problem with your PC.
Data recovery requires a decryptor.
 
If you want to restore them, write us to the e-mail:global-amnesia@india.com
Additional Mailing Address e-mail:xalienx@post.cz
 
 
Attention!
 * Do not rename encrypted files.
 * Do not try to uninstall the program or run antivirus software
 * Attempts to self-decrypt the files will lead to the loss of your data
 * Decoders of other users are incompatible with your data, as each user
 * Unique encryption key
 
====================================================================================================


I try to use decrypt_Amnesia.exe , But it does not work!

BC AdBot (Login to Remove)

 


#2 thyrex

thyrex

  • Members
  • 584 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Belarus
  • Local time:02:52 PM

Posted 09 May 2017 - 06:04 AM

Topic about Amnesia Ransomware here


Microsoft MVP 2012-2016 Consumer Security

Microsoft Reconnect 2016


#3 Tony_Ya

Tony_Ya
  • Topic Starter

  • Members
  • 8 posts
  • OFFLINE
  •  
  • Local time:07:52 PM

Posted 09 May 2017 - 06:12 AM

:thumbup2:



#4 quietman7

quietman7

    Bleepin' Janitor


  • Global Moderator
  • 51,726 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Virginia, USA
  • Local time:07:52 AM

Posted 09 May 2017 - 02:03 PM

Rather than have everyone with individual topics, it would be best (and more manageable for staff) if you posted any more questions, comments or requests for assistance in the above support topic discussion...it includes experiences by experts, a variety of IT consultants, end users and company reps who have been affected by ransomware infections. To avoid unnecessary confusion, this topic is closed.

Thanks
The BC Staff
.
.
Windows Insider MVP 2017-2018
Microsoft MVP Reconnect 2016
Microsoft MVP Consumer Security 2007-2015 kO7xOZh.gif
Member of UNITE, Unified Network of Instructors and Trusted Eliminators

If I have been helpful & you'd like to consider a donation, click 38WxTfO.gif




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users