Hi everyone, a couple days ago I scanned my computer using ESET NOD32 and found a virus named Win64/Sathurbot.A. It keeps giving my security alert. I tried to delete it but the alert will show again on the next reboot. How does it come to my computer? I don’t visit unknown websites or download untrusted software, everything I do is to watch youtube, facebook and download steam games. Is there any way I can do to get rid of this virus without recurring?
Win64/Sathurbot.A is classified as Trojan Horse that breaks into the target computer by exploiting software vulnerability and then attacks computers running with 64-bit Windows system. Usually the virus may arrive in files attached to e-mail and instant messages, come embedded into letters or get downloaded using peer-to-peer applications. Once access, it starts to perform various harmful activities, such as deleting important system files at random, adding malicious entries to the Windows registry, changing browser settings & HOSTS file, disabling antivirus program or even downloading other malware to the computer, etc. Unfortunately, it is very difficult to remove Win64/Sathurbot.A Trojan. Normally, anti-virus software won’t find all of it because it hides itself deep within the computer’s system files. Therefore, manual removal is considered to be the best way to get rid of this virus completely.
The ultimate aim of Win64/Sathurbot.A virus is to bring lots of malicious and deceitful advertisements or rogue software or viral documents to damage users’computers or swindle their money. Once your system is infected, you will find that PC performance is poor and your computer becomes very slow. It is almost impossible that you download any large file or watch videos online, even when you try to run any programs, the window keeps freezing and cursor keeps spinning so you are not able to open that. In addition, your web browser may behave weirdly, for example, you are directed to another site when attempting to visit Google and your default homepage or search engine is changed to other sites you never saw before. Victims should be aware that a hacker could use this nasty Trojan to steal your personal information. The virus can collect your confidential information like IP address, browsing habits, search terms, and online banking account details in the background and then send to third-parties for illegal purpose. To sum up, Win64/Sathurbot.A is a high-risk threat that has to be removed quickly without any hesitation.
1. This virus slows down your computer speed which make you in a trouble while opening program and surfing Internet. It takes forever to open a program or website.
2. Antivirus you have installed keeps popping up messages while you are surfing on the internet and showing you computer is at risk but you can’t get rid of it all.
3. This virus will shut down your other anti-virus and anti-spyware programs. And it will also infect and corrupt your registry, leaving your computer totally unsafe.
4. This virus will disable the proper running of many different programs or even disable some functions of your computer.
5. System restore can’t help to remove this Trojan completely.
From malicious drive-by-download scripts from corrupted porn and shareware / freeware websites.
Through spam email attachments, media downloads and social networks.
When clicking suspicious pop-ups or malicious links.
Open unknown email or download media files that contain the activation code of the virus.
Note: No matter how the virus accesses your PC, users should know that there are no tools can remove this pesky Trojan automatically at this moment, it is suggested users not spend much time in downloading or paying any security software which claims can delete this stubborn virus. It is totally useless. To completely get rid of Win64/Sathurbot.A, professional manual guide is needed.
Currently many computer users had the same experience that this virus couldn’t be removed by any anti-virus applications. So the manual approach is always required to combat this virus. And here is the step-by-step removal guide for all computer users.
1. End the malicious process from Task Manager.
Once Win64/Sathurbot.A virus is installed, computer user may notice that CPU usage randomly jumps to 100 percent. At any time Windows always has many running processes. A process is an individual task that the computer runs. In general, the more processes, the more work the computer has to do and the slower it will run. If your system’s CPU spike is constant and remain at a constant 90-95%, users should check from Task Manager and see if there is a suspicious process occupying system resources and then end it immediately.
(The name of the virus process can be random.)
Press Ctrl+Shift+Esc to quickly bring up Task Manager Window：
2. Show hidden files and folders.
Open Folder Options by clicking the Start button, clicking Control Panel, clicking Appearance and Personalization, and then clicking Folder Options.
Click the View tab.
Under Advanced settings, click Show hidden files and folders, uncheck Hide protected operating system files (Recommended) and then click OK.
3. Open Registry entries. Find out the malicious files and entries and then delete all.
Attention: Always be sure to back up your PC before making any changes.
a. Press Windows key + R to open Run box. In the “Open” field, type “regedit” and click the “OK” button.
Then a Registry Editor window will pop up as the following picture shows:
b. Search malicious files and registry entries and then remove all of them:
%AllUsersProfile%\[random]
%AppData%\Roaming\Microsoft\Windows\Templates\[random]
%AllUsersProfile%\Application Data\.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\[random]
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Temp
Win64/Sathurbot.A virus is malicious as it can be used to interfere with the normal operation of a computer, gather personal information or allow a hacker to access the device remotely without the user’s consent. It can perform tons of harmful activities as soon as it is installed such as taking up hard disk space and memory to slow down or even crash target PC, displaying unwanted pop-up ads and providing remote access to hackers by compromising the entire system or stealing passwords and other sensible information. Undoubtedly Win64/Sathurbot.A virus is a big potential threat to your computer. You should remove it immediately when you detected it on your computer.
Note: If you are not knowledgeable enough to be able to distinguish the location of this virus, or you are afraid of making mistake during the manual removal, please contact experts from Yoocare Online Tech Support for further help.
Published by on May 5, 2015 8:11 am, last updated on May 5, 2015 8:11 am
Leave a Reply
You must be logged in to post a comment.