Mahasaraswati Ransomware

Also Known As: Mahasaraswati virus
Distribution: Low
Damage level: Severe

Mahasaraswati ransomware removal instructions

What is Mahasaraswati?

Mahasaraswati is ransomware-type malware that encrypts various files stored on victims' computers. During encryption, Mahasaraswati appends the name of each encrypted file with the .id-[UNIQUE USER’S ID].{mahasaraswati(@)}.xtbl extension. Furthermore, this ransomware creates two files (.jpg and .txt) each named "How to decrypt your files", placing them in each folder containing the compromised files. These files contain identical messages stating that the files have been encrypted and that victims must contact cyber criminals via an email address provided to restore them.

Research shows that Mahasaraswati encrypts victims' files using the asymmetric encryption algorithm. Therefore, private and public keys are generated during encryption - public key to encrypt, and private to decrypt. Since it is impossible to restore encrypted files without the private key, cyber criminals encourage victims to buy this key, which is stored on remote servers controlled by cyber criminals. After contacting the email address provided, victims supposedly receive detailed information about payment. The size of ransom is equivalent to 3 Bitcoins ($1332.15~), however, this will increase by 2 Bitcoins every 24 hours. Therefore, the longer victims take to pay, the higher the ransom. Developers of Mahasaraswati offer decryption of a number of files (up to 10 Mb in total, but only .txt, or .jpg files) free of charge to prove that decryption is actually possible. The email reply also contains all payment instructions. Unfortunately, there are no tools capable of restoring files compromised by Mahasaraswati ransomware. Therefore, the only solution to this problem is to restore your system and/or files from a backup.

Screenshot of a message encouraging users to contact the developers of Mahasaraswati ransomware to decrypt their compromised data:

Mahasaraswati decrypt instructions

Ransomware-type viruses often have similar characteristics. Mahasaraswati, for instance, is very similar to Locky, Cerber, CryptXXX, and other malware. All ransomware is designed to infiltrate the system, encrypt stored files, and demand a ransom. The only noticeable differences are type of encryption algorithm used and size of ransom. Furthermore, your files are likely to remain encrypted even after you pay the ransom. Cyber criminals often ignore victims, despite payments made. Therefore, you should never attempt to contact them or pay any ransom. Ransomware-type viruses are often distributed via malicious email attachments, P2P (peer-to-peer) networks, fake software updates, and trojans. Therefore, be cautious when opening attachments sent from unrecognized email addresses and when downloading files from third party sources. Furthermore, keep your installed software up-to-date and use a legitimate anti-virus/anti-spyware suite.

Text presented in Mahasaraswati desktop wallpaper:

Keep calm, my friend.
All your data is encrypted.
TO get the key write on email mahasaraswati(@)

Screenshot of Mahasaraswati text file:

Mahasaraswati ransomware ransom-demanding message

Ransom demand message (presented in “How to decrypt your files.txt” and “How to decrypt your files.jpg” files):

Good morning, dear friend!
We are writing to inform you that our team of network security specialists has analyzed your system and has identified vulnerabilities in the protection.
We kindly draw your attention that defensive operation on your computer is not running properly and now the whole database is at risk.
All your files are encrypted and can not be accepted back without our professional help.
Obviously vulnerability analysis, troubleshooting, decoding the information and then ensuring safety are not a simple matter.
And so our high-grade and quick service is not free.
Please note that today the price of your files recovery is 3 Bitcoins, but next day it will cost 5 Bitcoins.
You should buy bitcoins here hxxps://
Read the paragraphs:
1. How to buy Bitcoins?
2. How do I send Bitcoins and how can I pay with Bitcoins after buying them?
The Bitcoin wallet for payment is 1DGMeKSALSkYGkedYDUgcvV8mP77WEGusQ
After the transfer of bitcoins please send email with screenshot of the payment page.
We does not advise you to lose time, because the price will encrese with each passing day.
As proof of our desire and readiness to help you, we can decipher a few of your files for test.
To check this you can upload any encrypted file on web site, size no more than 10 MB (only text file or a photo) and send us a download link.
Certainly after payment we guarantee prompt solution of the problem, decrypt the database to return to its former condition and consultation how to secure the rules of the system safety.
Kind regards, Saraswati.

Mahasaraswati ransomware removal:

Instant automatic malware removal: Manual threat removal might be a lengthy and complicated process that requires advanced computer skills. Malwarebytes is a professional automatic malware removal tool that is recommended to get rid of malware. Download it by clicking the button below:
▼ DOWNLOAD Malwarebytes By downloading any software listed on this website you agree to our Privacy Policy and Terms of Use. To use full-featured product, you have to purchase a license for Malwarebytes. 14 days free trial available.

Quick menu:

Step 1

Windows XP and Windows 7 users: Start your computer in Safe Mode. Click Start, click Shut Down, click Restart, click OK. During your computer start process, press the F8 key on your keyboard multiple times until you see the Windows Advanced Option menu, and then select Safe Mode with Networking from the list.

Safe Mode with Networking

Video showing how to start Windows 7 in "Safe Mode with Networking":

Windows 8 users: Start Windows 8 is Safe Mode with Networking - Go to Windows 8 Start Screen, type Advanced, in the search results select Settings. Click Advanced startup options, in the opened "General PC Settings" window, select Advanced startup. Click the "Restart now" button. Your computer will now restart into the "Advanced Startup options menu". Click the "Troubleshoot" button, and then click the "Advanced options" button. In the advanced option screen, click "Startup settings". Click the "Restart" button. Your PC will restart into the Startup Settings screen. Press F5 to boot in Safe Mode with Networking.

Windows 8 Safe Mode with networking

Video showing how to start Windows 8 in "Safe Mode with Networking":

Step 2

Log in to the account infected with the Mahasaraswati virus. Start your Internet browser and download a legitimate anti-spyware program. Update the anti-spyware software and start a full system scan. Remove all entries detected.

If you cannot start your computer in Safe Mode with Networking, try performing a System Restore.

Video showing how to remove ransomware virus using "Safe Mode with Command Prompt" and "System Restore":

1. During your computer start process, press the F8 key on your keyboard multiple times until the Windows Advanced Options menu appears, and then select Safe Mode with Command Prompt from the list and press ENTER.

Boot your computer in Safe Mode with Command Prompt

2. When Command Prompt mode loads, enter the following line: cd restore and press ENTER.

system restore using command prompt type cd restore

3. Next, type this line: rstrui.exe and press ENTER.

system restore using command prompt rstrui.exe

4. In the opened window, click "Next".

restore system files and settings

5. Select one of the available Restore Points and click "Next" (this will restore your computer system to an earlier time and date, prior to the Mahasaraswati ransomware virus infiltrating your PC).

select a restore point

6. In the opened window, click "Yes".

run system restore

7. After restoring your computer to a previous date, download and scan your PC with recommended malware removal software to eliminate any remaining Mahasaraswati ransomware files.

To restore individual files encrypted by this ransomware, try using Windows Previous Versions feature. This method is only effective if the System Restore function was enabled on an infected operating system. Note that some variants of Mahasaraswati are known to remove Shadow Volume Copies of the files, so this method may not work on all computers.

To restore a file, right-click over it, go into Properties, and select the Previous Versions tab. If the relevant file has a Restore Point, select it and click the "Restore" button.

Restoring files encrypted by CryptoDefense

If you cannot start your computer in Safe Mode with Networking (or with Command Prompt), boot your computer using a rescue disk. Some variants of ransomware disable Safe Mode making its removal complicated. For this step, you require access to another computer.

To regain control of the files encrypted by Mahasaraswati, you can also try using a program called Shadow Explorer. More information on how to use this program is available here.

shadow explorer screenshot

 To protect your computer from file encrypting ransomware such as this, use reputable antivirus and anti-spyware programs. As an extra protection method, you can use programs called HitmanPro.Alert and Malwarebytes Anti-Ransomware, which artificially implant group policy objects into the registry to block rogue programs such as Mahasaraswati ransomware.

HitmanPro.Alert CryptoGuard - detects encryption of files and neutralises any attempts without need for user intervention:

hitmanproalert ransomware prevention application

Malwarebytes Anti-Ransomware Beta uses advanced proactive technology that monitors ransomware activity and terminates it immediately - before reaching users' files:

malwarebytes anti-ransomware

  • The best way to avoid damage from ransomware infections is to maintain regular up-to-date backups. More information on online backup solutions and data recovery software Here.

Other tools known to remove Mahasaraswati ransomware:

About the author:

Tomas Meskauskas

Tomas Meskauskas - expert security researcher, professional malware analyst.

I am passionate about computer security and technology. I have an experience of over 10 years working in various companies related to computer technical issue solving and Internet security. I have been working as an author and editor for since 2010. Follow me on Twitter and LinkedIn to stay informed about the latest online security threats. Contact Tomas Meskauskas.

PCrisk security portal is brought by a company RCS LT. Joined forces of security researchers help educate computer users about the latest online security threats. More information about the company RCS LT.

Our malware removal guides are free. However, if you want to support us you can send us a donation.

Malware activity

Global malware activity level today:

Medium threat activity

Increased attack rate of infections detected within the last 24 hours.

QR Code
Mahasaraswati virus QR code
A QR code (Quick Response Code) is a machine-readable code which stores URLs and other information. This code can be read using a camera on a smartphone or a tablet. Scan this QR code to have an easy access removal guide of Mahasaraswati virus on your mobile device.
We Recommend:

Get rid of Windows malware infections today:

Download Malwarebytes

Platform: Windows

Editors' Rating for Malwarebytes:
Editors ratingOutstanding!

[Back to Top]

To use full-featured product, you have to purchase a license for Malwarebytes. 14 days free trial available.