How to remove Salsa222 virus and restore encrypted files

There are lots of harmful malware on the Internet, but ransomware is the worst. Most of adware only bring inconvenience, and the effects of their deeds can be easily eliminated, but ransomware inflicts substantial damage, and in most cases, you need to spend lots of resources to fix it. The encrypting ransomware is the worst thing that can happen to your workstation. In this entry we’ll explain you, how to uninstall Salsa222, and how you may probably restore the encoded information without money losses.

Salsa222 ransomware virus

Salsa222 sneaks into your machine via malicious additions in e-mail, and then promptly starts to encode folders. If you haven't stopped Salsa222 on the stage of infection, then your data will be encrypted. Almost all extensions of files that may be found on usual user's PC can be ciphered by this virus. The process takes from five minutes to 2-3 hours. Encryption duration might vary, it depends on the workstation power and the number of data stored on it. Web-criminals require you to pay BTC for your own data.

The majority of malware use extremely strong encryption algorithms like RSA-2048 and AES-128 that successfully protect the files of countries, military forces and major corporations. Salsa222 isn't an exception. This means that you only have one completely efficient technique to recover your files: to use the backup. The lack of backups mean that you can say goodbye to your files, because you have no guarantee that hackers, which hacked your PC, won’t cheat you again after the payment. The data may be recovered in few ways, but they are not really effective.

How to delete Salsa222 Virus

File recovery is the first task, which you worry about, when your PC is infected by Salsa222. Still, the virus should be deleted in order to shield new files. Regardless of which recovery way you will use, you still have to eliminate ransomware. The instant uninstall is needful if you prefer the manual decryption, or you are going to load the backups, and if you decide to pay the ransom - the virus should be removed after the complete file decryption. The removal can be performed with help of special antivirus program, or manually. Security and swiftness of both methods are the same, but the requirements for user experience and skill are extremely different. You have to be an experienced PC operator to perform the manual deletion with no errors. You must know what to do and how to prevent any error. Disposal via special tool doesn't need any experience of the user. You just should load the program, install it and run the scanning process. Under this paragraph, you'll find the detailed set of advices for removing of Salsa222. We accurately describe each part of removal process, to prevent any failures. But, if you don't like the manual deletion, and prefer the highest level of protection against any malware - you should try the reputable anti-viral tool.

Step 1. Boot into Safe mode

Safe mode

Start -> Msconfig.exe

Safe mode. Step 1

On the tab Boot select Safe boot

Safe mode. Step 2

Step 2. Check Startup folder

Start -> Msconfig.exe ->Disable unknown programs in the Startup tab


Step 3. Check hosts file

Modify hosts file, that located in C:\Windows\System32\drivers\etc\ .

Hosts file.Step 1

Open the file with Notepad and delete suspicious strings.

Hosts file.Step 2

It has to look like this:

Hosts file.Step 3

Step 4. Scan the system with antiviral scanner


Antivirus scanner

Why we recommend SpyHunter antimalware as removal tool

Removes virus fully: all files and even registry keys of malware will be deleted

Protects your system in the future

24/7 free support team

bwd  Instructions 1/2  fwd

Step 5. Disable Safe mode

Start -> Msconfig.exe ->Disable Safe boot in the Boot tab

Deactivate Safe mode

How to restore files encrypted by Salsa222

In this guide we have already mentioned that the user whose machine is captured with encrypting virus has only one entirely reliable way to restore files: to upload the backups. You should try these ways if there's no another choice, but be ready that they may fail. The main advantage of backup copies is that they are kept on the separate media, and are not available for viral impact. Other manners depend on the OS in-built services, and their efficiency may be minimized by the virus itself and the lack of skill. We can suggest you two more decryption techniques. You can use the shadow copy service, or a special program to restore the data. Decryption using the special decryptor is very efficient, but unfortunately, such a tool doesn't yet exist. News about the advancement in the creation of the program might be seen on EmsiSoft, MalwareHunterTeam and Kaspersky lab official web-pages. By-hand restore using Shadow Volume Copies might be made immediately. You can use the built-in Windows functionality, however, there are other programs that will make this task simpler. These tools are called Recuva and ShadowExplorer. Both of them are free, you might find them from the official websites, with detailed guide for their use. Read more about file restore here: File decryption guide.




Add comment

Security code

This website uses cookies to improve your experience. If you continue using the site, we will assume that you accept our cookies policy.