How to remove Satyr ransomware

Satyr ransomware is a new cyberthreat discovered by security experts in April

Satyr ransomware is a crypto-virus that encrypts all user files using AES^[1] and RSA-2048 encryption algorithm and appends .Satyr appendix to each of the files. This process makes data unusable, and until the ransom of 0.018 BTC is paid, the hackers will not disclose decryption key to the victim. The virus uses the same file – SF.exe – as Spartacus ransomware.

The malware enters users’ machines through malicious sites, links, infected downloads or spam emails. However, ransomware does not instantaneously lock up files. First, Satyr virus executes a chain of specific changes to system configuration to ensure that the malicious program loads with every computer boot up.

Then, the crypto-locker scans the computer for files (it can be any personal files, like video, music, PDF, text and other) that can be encrypted and executes the process by appending .Satyr extension. For example, the file that used to be called picture.jpg turns into picture.jpg.Satyr.

The virus also typically protects itself by disabling security software. Thus, users are recommended entering Safe Mode with Networking. From there, users should start up a reliable security tool (such as FortectIntego, SpyHunterCombo Cleaner or MalwarebytesMalwarebytes) and then proceed with Satyr removal.

As soon as ransomware completes its data encryption process, it drops a ransom note that explains to the user what happened:

Security tips

All your files have been encrypted due to a security problem with your PC. If you want to restore them, write us the Telegram: https://t.me/tony_montana10928 or @tony_montana10928 and send personal ID KEY: <…>

For Decrypt Your Personal Files Send 0.018 BTC to this address: <…>

You have to pay for decryption in Bitcoins. The price depends on how you write us. After payment we will send you decryption tool that will decrypt all your files

As evident, Satyr authors want victims to contact them via Telegram messenger after the payment of 0.018 BTC (around $147.5 at the time of writing) is processed. However, we do not recommend contacting hackers.

Cybercrooks are promising to send the decryption tool, but nobody guarantees that the file is not malware. This way, you could compromise your computer even more. What is more, if you show that ransom demands can be successful, hackers will create more viruses to extract more money out of innocent users.

Instead, you should remove Satyr ransomware and then proceed with file recovery procedure. Unfortunately, the only secure way to get data back is by recovering it for a remote server – like iCloud or Google Drive or from an external storage device. If you do not possess any back-ups, you can try alternative file recovery methods which we describe below this article.

Be careful when opening emails as they can contain the deadly ransomware payload

Security researchers^[2] noted that the most prevalent ransomware distribution method is via spam emails. Thus, users should be careful when handling new emails coming from unknown sources:

• Do not open emails carelessly, even if they seem legitimate;
• Do not open any attachments in the email. The contaminated file typically asks to enable macro function;^[3]
• Do not ignore the built-in security software warnings about phishing emails;
• Check the address the email was sent from to make sure it is legitimate;
• Do not click on any links inside the email. Keep in mind that hyperlinks enable hackers to disguise a malicious site inside the link.

Another dangerous place on the internet is all suspicious websites, including illegal software, pornographic, free online gaming, gambling and similar high-risk sites. Thus, stay away from them and close your browser if you get redirected.

Remove Satyr ransomware and recover your files

Ransomware infection is a serious threat and should not be taken lightly. Thus, do not try to remove Satyr virus manually. Not only you will fail to get rid of the malware but might also damage system files beyond repair.

Therefore, you should download and install reputable anti-malware software and start it in the Safe Mode with Networking. Then, scan your computer for full Satyr removal.