Mahasaraswati ransomware - How to remove

Mahasaraswati ransomware is a recent ransomware threat named after the eight-armed Hindu goddess. The ransom note of this cryptomalware has this goddess in the background. Mahasaraswati encoder just like TeslaCrypt, CryptoLocker and CryptoWall ransomwares (just to name a few) uses asymmetric encryption algorithm to corrupt the victim’s data.

About Mahasaraswati Ransomware

Once Mahasaraswati ransomware is on your computer, it begins encryption processes. RSA public and AES private keys are generated. The private key is stored in the remote servers controlled by the cyber crooks. The ransomware appends a clumsy .id-[UNIQUE USER’S ID].{mahasaraswati(@)india.com}.xtbl extension to encrypted files. How_to_decrypt_files.txt file is dropped in every folder of encrypted files and How_to_decrypt_files.png replaces the desktop wallpaper. These two files carry the ransom note. Currently the ransom demanded is 3 BTC (1,425.18 USD at the time of writing this article) which is a really hefty compensation in comparison with other ransomwares, such as Locky, which require around 0.5 BTC (237.59 USD). However, every 24 hours the ransom is increased by 2 BTC (950.21 USD). You are provided with the detailed instructions for payment and the contact e-mail [email protected] in the message. Interestingly, hackers makes an offer to decrypt up to 10 Mb of encrypted text files and images to prove that they truly have the decryption key and are able to decrypt the data.

How does Mahasaraswati Ransomware Spread?

The main method of Mahasaraswati Ransomware distribution is spam e-mails with malicious links or their infected attachments. The e-mails are either sent from unknown senders or presents as official letters from legitimate institutions or companies. Since this file encryptor is a trojan, it can come disguised as a useful application. If, in the latter cases, you are left with the choice whether to open the letters or install an app (which literally means getting infected), exploits will not do you such a favor. These will target system vulnerabilities and leave the door open for ransomwares to step in.

How to Decrypt Files Encrypted by Mahasaraswati Ransomware?

As bad luck would have it, there are not any decryption tools available at the moment. This crypto-virus deletes Shadow Volume Copies. So Volume Shadow Copy Service will be of no use here. However, you can still run data recovery tools such as PhotoRec, R-studio, etc. Generally, it is recommended to back up data on an external hard drive. Do not leave it plugged in but update it regularly.

To remove Mahasaraswati ransomware employ credible malware removal tools such as Spyhunter, Malwarebytes or StopZilla. Follow the removal instructions for this ransomware below.

How to recover Mahasaraswati ransomware encrypted files and remove the virus

Step 1. Restore system into last known good state using system restore

1. Reboot your computer to Safe Mode with Command Prompt:

for Windows 7 / Vista/ XP

• Start → Shutdown → Restart → OK.
• Press F8 key repeatedly until Advanced Boot Options window appears.
• Choose Safe Mode with Command Prompt.

for Windows 8 / 10

• Press Power at Windows login screen. Then press and hold Shift key and click Restart.
• Choose Troubleshoot → Advanced Options → Startup Settings and click Restart.
• When it loads, select Enable Safe Mode with Command Prompt from the list of Startup Settings.

 

2.Restore System files and settings.

• When Command Prompt mode loads, enter cd restore and press Enter.
• Then enter rstrui.exe and press Enter again.
• Click “Next” in the windows that appeared.
• Select one of the Restore Points that are available before Mahasaraswati ransomware has infiltrated to your system and then click “Next”.
• To start System restore click “Yes”.

 

Step 2. Complete removal of Mahasaraswati ransomware

After restoring your system, it is recommended to scan your computer with an anti-malware program, like Spyhunter and remove all malicious files related to Mahasaraswati ransomware . You can check other tools here.  

Step 3. Restore Mahasaraswati ransomware affected files using Shadow Volume Copies

If you do not use System Restore option on your operating system, there is a chance to use shadow copy snapshots. They store copies of your files that point of time when the system restore snapshot was created. Usually Mahasaraswati ransomware tries to delete all possible Shadow Volume Copies, so this methods may not work on all computers. However, it may fail to do so. Shadow Volume Copies are only available with Windows XP Service Pack 2, Windows Vista, Windows 7, and Windows 8. There are two ways to retrieve your files via Shadow Volume Copy. You can do it using native Windows Previous Versions or via Shadow Explorer. a) Native Windows Previous Versions Right-click on an encrypted file and select Properties → Previous versions tab. Now you will see all available copies of that particular file and the time when it was stored in a Shadow Volume Copy. Choose the version of the file you want to retrieve and click Copy if you want to save it to some directory of your own, or Restore if you want to replace existing, encrypted file. If you want to see the content of file first, just click Open.

b) Shadow Explorer It is a program that can be found online for free. You can download either a full or a portable version of Shadow Explorer. Open the program. On the left top corner select the drive where the file you are looking for is a stored. You will see all folders on that drive. To retrieve a whole folder, right-click on it and select “Export”. Then choose where you want it to be stored.

Step 4. Use Data Recovery programs to recover Mahasaraswati ransomware encrypted files

There are several data recovery programs that might recover encrypted files as well. This does not work in all cases but you can try this:

• We suggest using another PC and connect the infected hard drive as slave. It is still possible to do this on infected PC though.
• Download a data recovery program.
• Install and scan for recently deleted files.

Note: In many cases it is impossible to restore data files affected by modern ransomware. Thus I recommend using decent cloud backup software as precaution. We recommend checking out Carbonite, BackBlaze, CrashPlan or Mozy Home.

Manual removal