How to remove AgeLocker (.sthd2 file) ransomware

AgeLocker (.sthd2 file) ransomware is a malicious program designed to block access to users' files and demand money for a decryption tool

AgeLocker ransomware is a cryptovirus^[1] that encrypts data in the infected device. This ransomware^[2] also is known as .sthd2 file virus because all infected files get .sthd2 extension. The infection encrypts all types of files, such as pictures, video, banking data, or backups.

AgeLocker virus is a little bit different than other ransomware because it is using the age encryption library/binary of the cryptographer Filippo Valsorda. The victims get a ransom note via email.

All damaged data becomes inaccessible to victims. It is important to remember, that if the user tries to remove AgeLocker .sthd2 file virus, infected files still remain inaccessible. Nonetheless, malware termination is a necessary procedure if you want to avoid the encryption of the incoming files.

The AgeLocker virus ransom note looks like that:

Hello [redacted],
Unfortunately a malware has infected your network and a millions of files has been encrypted using a hybrid encryption scheme.
File names encrypted too.
Encrypted hosts are:
Storage:
1. [redacted] 2. [redacted] 3. [redacted] Mac + external drives
1. [redacted] 2. [redacted] 3. [redacted] You have to pay for decryption in Bitcoins.
The price depends on how fast you write us.
After payment we will send you the tool(for mac and linux) that will decrypt all your files.
Free decryption as guarantee
Before paying you can send us up to 5 files for free decryption.
The total size of files must be less than 4Mb (non archived), and files should not contain valuable information. (databases, backups, large excel sheets, etc.), file name shouldn’t be changed.
How to obtain Bitcoins
The easiest way to buy bitcoins is LocalBitcoins site. You have to register, click ‘Buy bitcoins’, and select the seller by payment method and price.
https://localbitcoins.com/buy_bitcoins
Also you can find other places to buy Bitcoins and beginners guide here:
http://www.coindesk.com/information/how-can-i-buy-bitcoins/
Attention!
Do not rename encrypted files.
Do not try to decrypt your data using third party software, it may cause permanent data loss.
Note: we can answer up to 6-9 hours, because of another timezone.

Sadly, a lot of people decide to pay the ransom. But the best option is to have backups, remove .sthd2 file ransomware, and fix any left damage with such tools as FortectIntego.

Avoid paying cybercriminals to recover .sthd2 files

While criminals are demanding to pay the ransom, cybersecurity experts^[3] strongly recommend not doing so. Although hackers want your money, there is no guarantee that even if you satisfy all requirements the decryption code will be granted to you. It is possible that you will be left not only without your .sthd2 files but also without money.

Instead, if you have no backups, we recommend trying alternative methods listed below for .sthd2 file recovery. In some cases, malware might fail to perform actions that it is meant to do, in which case data retrieval could be possible (for example, if the AgeLocker virus fails to delete Shadow Volume Copies).

Also, try to remember that you should be extra careful on the internet because such threats like ransomware are spreading through different sources. For example, you can download the infection through malicious attachments in e-mail messages, unofficial websites, or download it together with fake software cracking tools, keyloggers, etc.

Remove AgeLocker ransomware from your computer to avoid more damage

As we stated before, you should remove AgeLocker ransomware from your computer. You can do it manually or use an anti-malware program such as SpyHunterCombo Cleaner or MalwarebytesMalwarebytes. After the deletion, you may try to recover your files if you have backups in online servers or different devices. Also, remember to use such a tool as FortectIntego if you want to fix any OS damage.

Unfortunately, manual decryption is almost impossible. Even after AgeLocker virus removal, your infected files will stay encrypted. But you still should avoid talking to criminals or paying money because there is no guarantee that they help you.