Remove .AMBA Ransomware and Restore Encrypted Files - How to, Technology and PC Security Forum | SensorsTechForum.com

Remove .AMBA Ransomware and Restore Encrypted Files

fix-your-malware-problem-sensorstechforumThe AMBA virus, notorious for the fact that it encrypts the databases of websites with .amba file extension added to them has appeared on the radar. The crypto-virus directly attacks the “Index Of” belonging to websites whose servers are not properly secured. Its ransom note is written entirely in Russian language, and its variants have been reported to exist since the year 2013. All website publishers whose servers have been affected by the Amba ransomware are strongly advised to export the files and try to decrypt them instead of paying the requested ransom money.

Threat Summary

Name

AMBA

TypeRansomware
Short DescriptionEncrypts files of websites on infected servers and asks for ransom payoff for their decryption.
SymptomsThe user may witness a ransom note as a text document written in Russian, named “ПРОЧТИ_МЕНЯ.txt”.
Distribution MethodVia an Exploit kit, JavaScript or a Trojan.
Detection Tool See If Your System Has Been Affected by AMBA

Download

Malware Removal Tool

User ExperienceJoin our forum to Discuss WildFire Ransomware.
Data Recovery ToolWindows Data Recovery by Stellar Phoenix Notice! This product scans your drive sectors to recover lost files and it may not recover 100% of the encrypted files, but only few of them, depending on the situation and whether or not you have reformatted your drive.

AMBA Ransomware’s Distribution Scheme

Since Amba ransomware attacks mostly servers, it may use different approach instead of the convention massive spam campaign. For example, if the server is located in a network with other devices, the virus may use a worm to spread across the network to other devices. In addition to this, the creators of Amba may also send malicious URLs directly on the website as spam comments. Such web links may redirect to other URLs which may cause the infection via a drive-by-download. Another possibility is a targeted attack with a Trojan.Downloader, which can download AMBA ransomware’s malicious files, directly on the server.

AMBA Ransomware Viewed In Depth

As soon as it is executed on a given machine, AMBA begins to encipher files that are web server related, for example they may have the following extensions:

→ .4UI .ADB .AFP .ANH .ANTMPL .AO .AP .ARTICLE .AVERY .BCF .BCP .BIZ .BLK .BOOK .BPF .BRO .BRO .BTW .CADOC .CAJ .CAL .CBF .CD2 .CDF .CDML .CDOC .CEDPRJ .CH3 .CL2ARC .CL2DOC .CL2LYT .CL2TPL .CLD .CLKB .CLKBD .CLKC .CLKD .CLT .CNDX .COMICDOC .COMICLIFE .COMPOSITIONTEMPLATE .COV .CPE .CPH .CPY .CRTR .CSD .CST .CVW .CW .CWT .DCX .DMTEMPLATE .DOT .DPD .DRMX .DRMZ .DTL .DTP .DTX .DWDOC .EDRWX .ENC .ENV .FADEIN .FAX .FCDT .FD2 .FDD .FDT .FLB .FM .FOLIO .FORM .FP3 .FR3 .FRDOC .FRF .FSD .FXM .GEM .HCR .HFD .HFT .HMK .HPD .HPT .ICAP .ICML .ICMT .IDAP .IDML .IDMS .IDPK .IFD .ILDOC .IMM .IMTX .IMX .INCD .INCT .INCX .IND .INDB .INDD .INDL .INDP .INDS .INDT .INFOPATHXML .INP .INX .ISALE .ISALETEMPLATE .ISALLIC .ISD .JTP .JTX .JTX .LAB .LBL .LBL .LLD .LMA .LPDF .LSC .LST .LTF .MAILSTATIONERY .MARS .MAX .MBBK .MCSP .MCSX .MDI .MFO .MFP .MFT .MGA .MIF

After encrypting the databases of websites, the AMBA virus adds its own “trademark” – the AMBA file extension. Files of websites encrypted by AMBA look like the following image, reported by Amigo A – malware researcher at id-ransomware.blogspot.bg:

index-amba

After encrypting the files on the website of the server, AMBA ransomware uses a text file to notify users that their files have been encrypted. The file is named ПРОЧТИ_МЕНЯ.txt and has the following message in it:

“——————————————————————————–
Место для Вашей рекламы
——————————————————————————–
Вся Ваша информация (документы, базы данных, бэкапы)
на этом компьютере была зашифрована.
Для расшифровки обратитесь по нижеуказанным контактам.ПРОЧТИ_МЕНЯ.txt-ransom-note-sensorstechforum
Ни в коем случае не изменяйте файлы!
И не используйте чужие дешифраторы, Вы можете потерять Ваши файлы навсегда.
Каждый дешифратор – уникален, чужой – просто испортит Ваши файлы.
Благодоря нам – вы можете усилить свою безопасность
и предотвратить подобные ситуации!
——————————————————————————–
e-mail: [email protected]
———————————–
Ваш код для разблокировки: {UNIQUE VICTIM ID}
—————————————————————
Внимание! В первом письме не прикрепляйте файлы для дешифровки.
Все инструкции вы получите в ответном письме.”

The ransom message translates to the following:

Place for your advertisement.
All your information (documents, database files, backups) on this computer was encrypted. To decrypt it contact the belowmentioned contacts. Do not try to modify the files in any circumstance! Do not use foreign decryptors, you may lose your files forever. Every decrypter – unique, foreign will just break your files. Thanks to us, you can increase your safety and avoid such situations!
e-mail: [email protected]
Your decipher code: {UNIQUE VICTIM ID}
Attention! In the first letter do not attach the decipher code. Your will receive all instructions in the reply letter”

Remove AMBA Ransomware from Your Server

To get rid of AMBA ransomware, we strongly advise you to make sure to isolate the threat first. We have prepared a removal on how to get in safe mode and hopefully stop any processes which belong to AMBA Ransomware. You may also want to restore your files, for which there is no current decryptor. We have prepared instructions below which will help you to remove AMBA ransomware effectively from Windows servers and try to restore your files.

If you want to use the manual removal instructions, we advise you to look for it in the system folders of your server. In case you cannot find them and find any registry entries associated with AMBA, we advise you to follow the automatic removal instructions which are also recommended by experts. They include instructions on how to try alternative methods to get your files back.

Manually delete AMBA from your computer

Note! Substantial notification about the AMBA threat: Manual removal of AMBA requires interference with system files and registries. Thus, it can cause damage to your PC. Even if your computer skills are not at a professional level, don’t worry. You can do the removal yourself just in 5 minutes, using a malware removal tool.

1. Boot Your PC In Safe Mode to isolate and remove AMBA files and objects
2. Find malicious files created by AMBA on your PC
3. Fix registry entries created by AMBA on your PC

Automatically remove AMBA by downloading an advanced anti-malware program

1. Remove AMBA with SpyHunter Anti-Malware Tool
2. Back up your data to secure it against infections and file encryption by AMBA in the future
3. Restore files encrypted by AMBA
Optional: Using Alternative Anti-Malware Tools

Vencislav Krustev

A network administrator and malware researcher at SensorsTechForum with passion for discovery of new shifts and innovations in cyber security. Strong believer in basic education of every user towards online safety.

More Posts - Website

Leave a Comment

Your email address will not be published. Required fields are marked *

Time limit is exhausted. Please reload CAPTCHA.

Share on Facebook Share
Loading...
Share on Twitter Tweet
Loading...
Share on Google Plus Share
Loading...
Share on Linkedin Share
Loading...
Share on Digg Share
Share on Reddit Share
Loading...
Share on Stumbleupon Share
Loading...
Please wait...

Subscribe to our newsletter

Want to be notified when our article is published? Enter your email address and name below to be the first to know.