How to recover
Files Using Amnesia Decrypter
from Windows

I want to decrypt my files after they have been encrypted by Amnesia ransomware. What is the best way to do it?

The best way to decrypt this parasite is to use Amnesia Decrypter. This tool is just fresh out of the malware investigators’ workshop and will help you get back access to your files without any charge. But before we get into detail on how to use the decrypter, we’d like to give a brief reminder of how this virus works and what characteristics does it possess. We hope this helps victims recognize the virus quicker and take appropriate action against it.

Amnesia virus is a Delphi-based crypto-ransomware which means that one of its first characterizing features is the encryption it uses to render files inaccessible. For this purpose, it applies AES-256 encryption which is one of the commonly used algorithms among the ransomware creators. In addition to the encryption, the virus also appends all the files with “.amnesia” extensions, indicating that these files are now in possession of the cyber criminals. The virus drops a ransom note called HOW TO RECOVER ENCRYPTED FILES.TXT on all of the infected computer folders so that the victims would have no other option but to notice it. The document itself features directions on how to recover the files. As you can probably suspect, this involves paying a ransom. The specific sum required depends on the importance and volume of the encrypted files and is given to the victims after they contact the criminals with their personal identifier via [email protected]. However, as the Amnesia Decrypter has already been released, there is no need even to consider the possibility of paying the ransom. You can simply go to the Emsisoft’s official website and download the decryptor for free. Do not wander around the web when looking for the decryption tools and go straight to the legitimate and trusted sources. Otherwise, you may end up with some malicious software on your computer and damage your system even more than it already is. If you are sure you have obtained the right software, follow the guidelines below to use it properly.

Step 1: Preparation

First and foremost, before obtaining any decryption software, make sure you clean up your device from the ransomware itself. Scan the system with [rev id=”Reimage”] or some similar anti-malware tool and get rid of every piece of malicious component that might belong to this vicious infection. If it’s your first time decrypting data, we strongly advise making backup copies of the encrypted files so that in case the decryption fails, you will not lose your files. When that’s done, you may then download Amnesia Decrypter.

Step 2: Operating the Amnesia Decrypter

The key to Amnesia Decrypter and generally, any Emsisoft decrypter is to have one encrypted and one non-encrypted version of the same file. The software automatically compares the two variants of the file and comes up with a private decryption key. The same key may then applied to the remaining files to decrypt them.

1. When you find the required files drop them on the indicated decryption window area.
2. The key extraction process is carried out automatically, so all you have to do is to wait until the “Decryption key found” table pops-up. When it does, click OK.
3. The following table will ask you to confirm the “Licence terms”. Do that by clicking OK again.
4. Eventually, you will end up on a Decrypter’s window asking you to select what computer partitions, folders or files you want to decrypt.
5. Confirm your selections by clicking “Decrypt” button. The software will then begin the data recovery.

We strongly recommend you to scan your device with trustworthy antivirus tool after you are done with the recovery to prevent secondary encryption.