Shiva Ransomware

Shiva Ransomware is one of the latest discoveries of malware researchers at pcthreat.com. It was not a prevalent threat yet at the time of writing, but this might change soon, so you should not be so sure that it cannot enter your system. If Shiva Ransomware ever shows up on your PC, it will not necessarily encrypt your files because the version our specialists tested does not encrypt a single file. According to them, it is only a question of time when it is updated and starts encrypting all popular formats of pictures, documents, and other important files. If you are one of those lucky users whose files have not been encrypted after the successful entrance of Shiva Ransomware, we have only one piece of advice for you – delete the ransomware infection as soon as possible. In case you have found your files having the .shiva extension appended, it means that Shiva Ransomware has already affected them, but it surely does not mean that you should pay money to cyber criminals. You might be told that there is no other way to decrypt files, but it is not true. You could restore the encrypted data from a backup after erasing ransomware fully from your computer.

Although Shiva Ransomware does not encrypt files, specialists have not made a mistake by putting it into the category of ransomware because the ransom note hk.html it drops on affected machines proves that all it wants from users is their money. It contains only one sentence: “Files has been encrypted with SHIVA Send me some bitcoins or say goodbye to your files....” As can be seen, cyber criminals behind Shiva Ransomware want money in Bitcoins, but, of course, you should not transfer your money to them on any account. Actually, even if you make a decision to make a payment, you might not be able to do that if the version encountered is the same our specialists analyzed because its ransom note contains only one sentence (see above), and it does not provide any payment details that are necessary to transfer the required money. Most probably, the updated version of Shiva Ransomware, i.e., the one that will encrypt users’ files, will include the BTC address and step-by-step payment instructions in its ransom note or, at least, leave an email so that victims could contact cyber criminals and get data decryption instructions. Needless to say, our experienced specialists do not recommend purchasing the decryptor/key from the creator of Shiva Ransomware because it might be completely useless. On top of that, there are no guarantees that you will get it even if you send Bitcoins as instructed.

Ransomware infections are among the threats that do not need permission to enter users’ computers, so it is not at all surprising that so many users say that it has appeared on their PCs out of the blue. Specialists say that it is not easy to tell exactly how this threat is spread due to the fact that it has not affected many computers yet; however, according to them, it should travel the same as other ransomware infections. That is, it should be spread as an attachment in spam emails. These attachments are usually masqueraded as important documents, so many users, even those who are well aware of the fact that it is dangerous to open spam emails, get infected with the ransomware infection by opening such a “document” once. Of course, we do not say that it is the only way ransomware infections are distributed. Specialists say that ransomware infections might be available on dubious pages too, so carefully check all software you download from the web.

Shiva Ransomware is not a threat that makes significant changes on compromised machines. Because of this, its removal should be quick and easy. You only need to delete all suspicious files you have downloaded recently and a ransom note hk.html from Desktop. We recommend using our manual removal guide if you have never deleted malware manually. If the manual method is not for you, you can erase malware from your PC automatically as well. Only one full system scan using a powerful scanner and you will no longer have any active threats on your computer.

How to delete Shiva Ransomware

1. Open Explorer (press Win+E).
2. Go to %USERPROFILE%\Downloads and %USERPROFILE%\Desktop.
3. Delete suspicious recently downloaded software.
4. Remove the hk.html file from %USERPROFILE%\Desktop.
5. Empty Recycle bin.