• Downloads
  • Threats
    • Adware
    • Browser Hijacking
    • Phishing
    • Ransomware
  • Questions and Answers
  • Recover Encrypted Files
  • Free Malware Removal Tools

MyAntiSpyware

Menu
  • Downloads
  • Threats
    • Adware
    • Browser Hijacking
    • Phishing
    • Ransomware
  • Questions and Answers
  • Recover Encrypted Files
  • Free Malware Removal Tools

.Adame file extension. How to remove virus. Restore .Adame files.

Myantispyware team October 27, 2019    

What is a Adame file? A file with the .Adame extension is a file that has been locked by Adame ransomware that belongs to Phobos ransomware family. It uses strong encryption in order to block all files on the victim’s computer. It’s not possible to open the files by simply changing the file extension.

Adame file extension ransomware

‘.Adame file extension’ ransomware

Adame file virus is a new ransomware. What is ransomware? Ransomware is a type of malicious software which blocks access to files, by encrypting them, until the victim pays a ransom to the cyber criminals. In many cases, the ransom demand comes with a deadline. If the user does not make a payment within this time frame, the amount will be higher or the locked documents, photos and music are gone forever. Adame can encrypt almost all types of files, including common as:

.x3d, .raf, .xxx, .wcf, .srw, .wn, .das, .zi, .js, .wpd, .pfx, .xbplate, .3ds, .sql, .der, .blob, .wsc, .icxs, .wpa, .pptm, .wpg, .iwd, .wbc, .cr2, .fpk, .itdb, wallet, .ppt, .mpqge, .p12, .dmp, .cdr, .wpw, .d3dbsp, .xlk, .zw, .ysp, .ptx, .arch00, .syncdb, .erf, .mov, .xyp, .vcf, .desc, .rwl, .wdp, .png, .css, .mdb, .cer, .odm, .psd, .csv, .wma, .xx, .wbmp, .xmind, .flv, .lrf, .py, .wdb, .pkpass, .kdc, .t12, .mrwref, .xll, .yal, .big, .mdf, .sidn, .dwg, .db0, .docx, .bar, .odb, .rim, .wbz, .slm, .vtf, .lbf, .jpg, .xar, .zip, .wm, .vpk, .docm, .apk, .wp7, .1st, .gho, .xwp, .sid, .pem, .doc, .wps, .2bp, .bay, .xpm, .wps, .mlx, .xlsx, .qic, .epk, .mp4, .xmmap, .zip, .menu, .arw, .srf, .z3d, .pdd, .bkf, .wsh, .xlsx, .esm, .accdb, .zdb, .kdb, .wb2, .layout, .rw2, .xdl, .gdb, .jpe, .hplg, .mdbackup, .xml, .mef, .hkx, .bsa, .rofl, .zdc, .xbdoc, .w3x, .crw, .odt, .wot, .y, .bc6, .wmd, .ws, .m4a, .pdf, .sie, .xdb, .z, .wmv, .dxg, .m2, .wp4, .cas, .ods, .tax, .nrw, .eps, .wbd, .dba, .wpl, .cfr, .wav, .rgss3a, .wsd, .hkdb, .vpp_pc, .iwi, .svg, .ntl, .bkp, .wpt, .tor, .forge, .ncf, .xls, .qdf, .wbk, .rtf, .sav, .orf, .x3f, .asset, .wpb, .ztmp, .ai, .map, .xlgc, .wbm, .pef, .xls, .dazip, .wgz, .3dm, .wmv, .0, .ibank, .xyw, .wpe, .wp5, .dcr, .fos, .x, .yml, .wmf, .sum, .re4, .rb, .wma, .sidd, .webdoc, .zabw, .x3f, .snx, .litemod, .bik, .xld, .raw, .xy3, .3fr, .wmo, .mcmeta, .upk, .pptx, .vfs0, .avi, .1, .itm, .wp6, .lvl, .webp

Upon encryption, all affected personal files will then be appended with the .Adame extension. Researchers have found several versions of this virus, each of which uses a partially different extension:

  • .[supportcrypt2019@cock.li].Adame
  • .[checkcheck07@qq.com].Adame
  • .[raynorzlol@tutanota.com].Adame
  • .[recovermyfiles2019@thesecure.biz].Adame

So if the file had the name ‘document.doc’ before encryption, then after it was encrypted, it will be renamed to ‘document.doc.id[9ABD009CD0-5104].[recovermyfiles2019@thesecure.biz].Adame’.

Adame ransomware leaves a ransom demanding message called ‘info.txt’ with instructions for extortion and ransom payment. The ransom message directs victims to make payment online in crypto currency.

Threat Summary

Name Adame
Type Ransomware, File locker, Crypto virus, Crypto malware, Filecoder
Encrypted files extension .Adame
Ransom note info.txt, info.hta
Ransomare process name The App that Reminds You to Move More
Contact supportcrypt2019@cock.li, checkcheck07@qq.com, raynorzlol@tutanota.com, recovermyfiles2019@thesecure.biz, supportcrypt2019@protonmail.com
Ransom amount $300-$1000 in Bitcoins
Symptoms Your files fail to open. Files encrypted with .Adame file extension. Your documents, photos and music have new extension appended at the end of the file name. Files called like ‘info.txt’, ‘info.hta’, or ‘info’ in each folder with at least one encrypted file.
Distribution methods Phishing Emails that is carefully designed to trick a victim into opening an attachment or clicking on a link that contains a malicious file. Drive-by downloads (crypto virus has the ability to infect the PC system simply by visiting a website that is running harmful code). Social media posts (they can be used to entice users to download malware with a built-in ransomware downloader or click a malicious link). USB key and other removable media.
Removal To remove Adame ransomware use the removal guide
Decryption To decrypt Adame ransomware use the steps

 

If you came across this blog post, you were probably looking for a way on how to remove Adame, which does not involve paying the money. The goal of this article is to provide you with the necessary instructions that can allow you understand how delete crypto malware and decrypt (restore) files that have been locked.

Quick links

  1. How to remove Adame ransomware virus
  2. How to decrypt .Adame files
  3. How to restore .Adame files
  4. How to protect your PC system from Adame crypto malware?

How to remove Adame ransomware virus

Malware removal tools are pretty useful when your personal computer is affected by ransomware virus. Below we list the best utilities that be able to identify and remove Adame crypto virus from your computer.



remove Adame virus with Zemana Anti-Malware (ZAM)

Zemana Anti-Malware is a program which is used for worms, adware software, ransomware, malicious software, spyware, trojans and other security threats removal. The program is one of the most efficient antimalware utilities. One of the biggest advantages of using Zemana Anti-Malware (ZAM) is that is easy to use and is free. Also, it constantly keeps updating its virus/malware signatures DB. Let’s see how to install and check your PC with Zemana in order to remove Adame ransomware virus from your computer.

Now you can set up and run Zemana Anti Malware (ZAM) to delete Adame ransomware from your browser by following the steps below:

Visit the page linked below to download Zemana Anti-Malware setup file named Zemana.AntiMalware.Setup on your PC system. Save it to your Desktop so that you can access the file easily.

Zemana AntiMalware
Zemana AntiMalware
165082 downloads
Author: Zemana Ltd
Category: Security tools
Update: July 16, 2019

Start the setup file after it has been downloaded successfully and then follow the prompts to install this utility on your computer.

Zemana Anti Malware SetupWizard

During install you can change certain settings, but we recommend you don’t make any changes to default settings.

When install is finished, this malicious software removal utility will automatically launch and update itself. You will see its main window as on the image below.

Now click the “Scan” button to search for Adame ransomware and other security threats. This procedure may take some time, so please be patient. While the tool is scanning, you can see number of objects and files has already scanned.

Zemana Anti-Malware (ZAM) detect Adame ransomware and other security threats

Once the scan get completed, Zemana will display a scan report. When you’re ready, click “Next” button.

Zemana AntiMalware (ZAM) scan is done

The Zemana AntiMalware (ZAM) will remove Adame ransomware and other security threats and move threats to the program’s quarantine. Once the task is done, you can be prompted to restart your computer to make the change take effect.

Remove Adame with MalwareBytes

Manual Adame virus removal requires some computer skills. Some files and registry entries that created by the crypto virus can be not completely removed. We recommend that use the MalwareBytes that are completely clean your PC system of ransomware infection. Moreover, this free application will help you to uninstall malware, PUPs, adware and trojans that your machine can be infected too.
 
MalwareBytes Anti-Malware for MS Windows, scan for crypto virus is done
 

  1. Download MalwareBytes Free from the link below.
    Malwarebytes Anti-malware
    Malwarebytes Anti-malware
    327301 downloads
    Author: Malwarebytes
    Category: Security tools
    Update: April 15, 2020
  2. Once the download is finished, close all apps and windows on your machine. Open a file location. Double-click on the icon that’s named mb3-setup.
  3. Further, click Next button and follow the prompts.
  4. Once installation is done, press the “Scan Now” button to search for Adame ransomware, other malicious software, worms and trojans. This process can take quite a while, so please be patient. While the MalwareBytes AntiMalware utility is scanning, you can see how many objects it has identified as being infected by malware.
  5. After MalwareBytes AntiMalware completes the scan, MalwareBytes will display you the results. Review the scan results and then press “Quarantine Selected”. When finished, you may be prompted to reboot your PC.

The following video offers a steps on how to remove hijacker infections, adware and other malware with MalwareBytes.

Remove Adame ransomware with Kaspersky virus removal tool

Kaspersky virus removal tool (KVRT) is free and easy to use. It can scan and remove ransomware such as Adame virus, other malware, worms, adware, spyware and trojans. KVRT is powerful enough to find and remove malicious registry entries and files that are hidden on the computer.

Download Kaspersky virus removal tool (KVRT) by clicking on the following link. Save it to your Desktop so that you can access the file easily.

Kaspersky virus removal tool
Kaspersky virus removal tool
129307 downloads
Author: Kaspersky® lab
Category: Security tools
Update: March 5, 2018

After the downloading process is done, double-click on the KVRT icon. Once initialization process is finished, you’ll see the Kaspersky virus removal tool screen as displayed on the screen below.

Kaspersky virus removal tool main window

Click Change Parameters and set a check near all your drives. Click OK to close the Parameters window. Next press Start scan button to begin checking your machine for Adame ransomwaree, other trojans and malicious apps. A system scan may take anywhere from 5 to 30 minutes, depending on your PC system. While the KVRT tool is scanning, you can see how many objects it has identified as being infected by malicious software.

Kaspersky virus removal tool scanning

After the system scan is done, you may check all threats found on your system as displayed in the following example.

Kaspersky virus removal tool scan report

Once you have selected what you wish to remove from your machine click on Continue to start a cleaning process.

How to decrypt .Adame files

Unfortunately, at the moment there is no way to decrypt files that were blocked by the ransomware. Researchers and antivirus companies are trying to find a way to decrypt .Adame files, but so far no free decryptor has been created.

Should you pay the ransom

Never pay the ransom! Nevertheless, everyone has to remember that paying the authors of Adame ransomware who are threatening you is a terrible idea. You can pay this money, but there is no guarantee that your data will be yours again. That is the reason why you should consider other options (that do not involve paying the cyber criminals) in order to restore access to blocked files.

Files encrypted by ransomware

You can not wait for a free decryptor to be created, there are a couple more ways that can help you recover the content of encrypted files. On this post below you will find useful instructions on how to restore encrypted files for free.

How to restore .Adame files

Fortunately, there is little opportunity to restore files which have been encrypted by Adame ransomware. Data restore tools can help you! Many victims of various ransomware, using the steps described below, were able to restore their files. In our guide, we recommend using only free and tested software called PhotoRec and ShadowExplorer. But before you go on to file recovery, you need to check your computer for malware, find and delete Adame ransomware!




Use shadow copies to recover .Adame files

In some cases, you have a chance to recover your photos, documents and music which were encrypted by the Adame crypto malware. This is possible due to the use of the utility called ShadowExplorer. It is a free application that designed to obtain ‘shadow copies’ of files.

ShadowExplorer can be downloaded from the following link. Save it on your Desktop.

ShadowExplorer
ShadowExplorer
439693 downloads
Author: ShadowExplorer.com
Category: Security tools
Update: September 15, 2019

Once the download is finished, open a directory in which you saved it. Right click to ShadowExplorer-0.9-portable and select Extract all. Follow the prompts. Next please open the ShadowExplorerPortable folder as shown on the screen below.

ShadowExplorer folder

Start the ShadowExplorer tool and then select the disk (1) and the date (2) that you want to restore the shadow copy of file(s) encrypted by the Adame crypto virus as shown in the figure below.

ShadowExplorer restore files encrypted by the Adame crypto malware

Now navigate to the file or folder that you wish to recover. When ready right-click on it and press ‘Export’ button as displayed on the image below.

ShadowExplorer recover file

Restore .Adame files with PhotoRec

Before a file is encrypted, Adame ransomware virus makes a copy of this file, encrypts it, and then deletes the original file. This can allow you to recover your documents, photos and music using file recover software like PhotoRec.

Download PhotoRec on your Microsoft Windows Desktop by clicking on the following link.

PhotoRec
PhotoRec
221340 downloads
Author: CGSecurity
Category: Security tools
Update: March 1, 2018

When downloading is complete, open a directory in which you saved it. Right click to testdisk-7.0.win and choose Extract all. Follow the prompts. Next please open the testdisk-7.0 folder as shown in the following example.

testdisk photorec folder

Double click on qphotorec_win to run PhotoRec for Windows. It will open a screen such as the one below.

PhotoRec for windows

Select a drive to recover as on the image below.

photorec choose drive

You will see a list of available partitions. Select a partition that holds encrypted personal files similar to the one below.

photorec choose partition

Press File Formats button and specify file types to recover. You can to enable or disable the restore of certain file types. When this is done, press OK button.

PhotoRec file formats

Next, click Browse button to select where restored photos, documents and music should be written, then click Search.

photorec

Count of recovered files is updated in real time. All restored photos, documents and music are written in a folder that you have selected on the previous step. You can to access the files even if the restore process is not finished.

When the recovery is done, click on Quit button. Next, open the directory where recovered files are stored. You will see a contents similar to the one below.

PhotoRec - result of recovery

All restored documents, photos and music are written in recup_dir.1, recup_dir.2 … sub-directories. If you are searching for a specific file, then you can to sort your restored files by extension and/or date/time.

How to protect your PC system from Adame crypto malware?

Most antivirus applications already have built-in protection system against the ransomware. Therefore, if your machine does not have an antivirus application, make sure you install it. As an extra protection, use HitmanPro.Alert. It is a small security tool that can check the system integrity and alerts you when critical system functions are affected by malware. HitmanPro.Alert can detect, remove, and reverse ransomware effects.

Visit the page linked below to download the latest version of HitmanPro.Alert for MS Windows. Save it to your Desktop so that you can access the file easily.

HitmanPro.Alert
HitmanPro.Alert
6880 downloads
Author: Sophos
Category: Security tools
Update: March 6, 2019

When the download is finished, open the directory in which you saved it. You will see an icon like below.

HitmanPro.Alert file icon

Double click the HitmanPro.Alert desktop icon. After the utility is started, you will be displayed a window where you can choose a level of protection, as on the image below.

HitmanPro.Alert install

Now click the Install button to activate the protection.

 

Virus

 Previous Post

How to remove Bigstream.online pop-ups (Virus removal guide)

Next Post 

How to remove Gunnepaa.xyz pop-up redirect [Chrome, Firefox, IE, Edge]

Author: Myantispyware team

Myantispyware is an information security website created in 2004. Our content is written in collaboration with Cyber Security specialists, IT experts, under the direction of Patrik Holder and Valeri Tchmych, founders of Myantispyware.com.

Leave a Reply Cancel reply

New Guides

Jezidexp.com MrBeast $1111? Fake Promo Code Scams Exposed
scam alert
Feastax.com Review, FREE $3,000 Scam, Fake MrBeast Promo Codes
Anchomoross.com Virus Removal Guide
scam alert
Fake or Real? You Visited Some Hacked Websites With Exploit Email Scam Explained
scam alert
Spotify Can’t Process Your Payment Scam Alert: A Phishing Email to Avoid

Follow Us

Search

Useful Guides

How to reset Google Chrome settings to default
Best free malware removal tools
Best Free Malware Removal Tools 2025
DNSChanger
How to remove DNSChanger malware virus [Updated Apr. 2018]
Managed by your organization chrome virus
Chrome Managed by your organization malware removal guide
adwcleaner
AdwCleaner – Review, How to use, Comments

Recent Guides

Bigstream.online
How to remove Bigstream.online pop-ups (Virus removal guide)
Latforddom.pro
How to remove Latforddom.pro pop-ups (Virus removal guide)
1KkvvGKNwkDTBwX9u8R3qFFMS8VZmb3KyD Bitcoin Email Scam
1KkvvGKNwkDTBwX9u8R3qFFMS8VZmb3KyD Bitcoin Email Scam
Files encrypted with .derp extension
.Derp file extension. How to remove virus. Restore, Decrypt .derp files.
mentcosme.info
How to remove Mentcosme.info pop-ups (Virus removal guide)

Myantispyware.com

Myantispyware has been a trusted source for computer security and technology advice since 2004. Our mission is to provide reliable tech guidance and expert, practical solutions to help you stay safe online and protect your digital life.

Social Links

Pages

About Us
Contact Us
Privacy Policy

Copyright © 2004 - 2024 MASW - Myantispyware.com.