SATANA Ransomware

What is SATANA Ransomware?

SATANA Ransomware is a new computer infection that threatens to lock personal files. It is quite prevalent on the web these days, and it has been noticed that it shares similarities with such popular infections as Mischa Ransomware and Petya Ransomware. First of all, it locks files it finds stored on the computer with an intention of stealing money from computer users. Secondly, it modifies the MBR (Master Boot Record) in order to make it impossible for the Windows OS to load up. The only thing that users will see is the message covering the entire screen. It will say that the user has become the victim of SATANA Ransomware to explain why all the files are locked. In addition, a user will be offered to buy the decryption tool to unlock files. To be honest, the decryptor will be of no use here because this ransomware will not fix the Master Boot Record for you. In other words, you will not be able to unlock and access your files even if you transfer the required sum, so you should not waste your money. Instead, you should hurry to remove SATANA Ransomware from your computer to fix your Windows OS and thus use the computer normally again.

What does SATANA Ransomware do?

It is clear that SATANA Ransomware will encrypt files located on local disks and unmapped network shares. Researchers at anti-spyware-101.com have revealed that this computer infection will lock .bak, .jpg, .jpe, .mdf, .ppt, .pas, .asm, .dxf, .gif, .cry, .stl, .tif, and other files, mainly pictures and documents. Also, it will delete Shadow Copies of files to make sure that users cannot recover them easily. Once it is done with the files, it will create the .txt file (satana.txt) with the long text in every folder containing encrypted files. Users are informed in the .txt file that their files are encrypted and they need to pay 0.5 Bitcoins (approximately $340) to get the private key for unlocking files. As we have already mentioned, the key will not be effective because this ransomware infection modifies the MBR and is not going to restore the changes to allow the operating system to load up. In other words, you might receive the private key but you will not be able to use it. The key will not unlock files for you even if you use it after you repair the MBR, so there is no point in purchasing it. You should not do that especially if you have copies of your pictures and documents because it means that you have not lost them forever and can recover them easily.

Where does SATANA Ransomware come from?

SATANA Ransomware does not apply many changes to the system once it infiltrates the computer. It has only been found that it puts the copy of the executable file (.exe) in the %TEMP% directory and then launches from there. According to specialists at anti-spyware-101.com, SATANA Ransomware, in most cases, is spread through legitimate-looking spam emails. It appears in these emails as a decent-looking file, for example, it might pretend to be an invoice from a reliable company, e.g. DHL. To protect your system from other file-locking ransomware infections like Cerber Ransomware, Anonpop Ransomware, and Mircop Ransomware, you need to ignore spam emails you receive. Also, security specialists say that you need to acquire and install a reliable antimalware scanner on your system. If you do not want to make a mistake, install SpyHunter. We can guarantee that it will not allow undesirable software to enter your system again.

How to delete SATANA Ransomware

As you already know, SATANA Ransomware modifies the Master Boot Record in order not to allow the Windows OS to load up and thus puts its message on the screen. Therefore, you will have to fix the MBR to be able to use your computer normally again. You can reinstall your Windows OS as well, but we believe that it will be easier and quicker to restore the changes made by the ransomware infection and then delete the malicious file from %TEMP%. To make it easier for you to get rid of SATANA Ransomware, we suggest using our manual removal instructions you can find below. After you fix the MBR and your PC runs normally again, you should scan your computer with an automatic malware remover too to delete the remaining threats and the components of the ransomware infection, if there are any left on the system.

Remove SATANA Ransomware manually

Fix the MBR (Master Boot Record)

Windows XP

1. Insert the CD of your Windows XP in the CD-ROM.
2. Press any key to boot.
3. Tap R to open the Recovery Console.
4. Type 1 and tap Enter if Windows XP is your only OS.
5. Enter your administrator password and hit Enter.
6. Tap Y and then hit Enter.
7. Remove the CD from your CD-ROM.
8. Type exit and then tap Enter to restart your PC.

Windows Vista

1. Boot from your Windows Vista CD.
2. Select your language and the layout of the keyboard.
3. Click Repair your computer.
4. Select the operating system.
5. Click Next.
6. Open Command Prompt.
7. Type these commands: bootrec /FixMbr, bootrec /FixBoot, and bootrec /RebuildBcd.
8. Tap Enter after you enter each of the commands.
9. Remove your CD and type exit.
10. Tap Enter.

Windows 7

1. Insert your Windows 7 installation DVD.
2. Press any key.
3. Select your language and the keyboard layout.
4. Click Next.
5. Select the OS.
6. Click Next.
7. Click Command Prompt to open it.
8. Type bootrec /rebuildbcd. Press Enter.
9. Type bootrec /fixmbr. Press Enter.
10. Type bootrec /fixboot. Press Enter.
11. Remove the DVD and restart your computer.

Windows 8/8.1/10

1. Boot from the DVD.
2. Click Repair your computer at the Welcome screen.
3. Click Troubleshoot and open Command Prompt.
4. Type bootrec /FixMbr and tap Enter.
5. Type bootrec /FixBoot and tap Enter.
6. Type bootrec /ScanOs and tap Enter.
7. Type bootrec /RebuildBcd and tap Enter.
8. Remove the DVD disk.
9. Type exit and then tap Enter on the keyboard.
10. Reboot your computer.

Delete files

1. Find and delete the malicious file you have downloaded.
2. Tap Win+E simultaneously.
3. Enter %TEMP% in the address line and tap Enter.
4. Locate the copy of the malicious file and remove it.
5. Remove satana.txt files from directories containing encrypted files.
6. Empty the Recycle bin.
7. Restart PC.

Download Removal Tool100% FREE spyware scan and
tested removal of SATANA Ransomware*