SOPHOS Ransomware (.Sophos Files) — How to remove?

This ransomware uses the same name as the famous cybersecurity vendor – Sophos Group. It has a lot of different products related to cybersecurity, and when you google “Sophos ransomware”, you will likely get the results with articles from this vendor about the ransomware threat. To find the sites related to the same-named ransomware, you must open the second or even the third page. Such a tricky way to hide the solutions from users is not new.

What is known about the Sophosvirus?

The pattern of renaming is the following: [email].[victim id].Sophos. In the process of encryption, a file entitled, for example, “report.docx” will be turned into “report.docx.[][ZRDUT4AGKS5CVM7].Sophos”.

In every directory with the encoded files, a Decrypt-me.txt text file will be created. It is a ransom money memo. Therein you can find information about the ways of paying the ransom and some other information. The ransom note most probably contains a description of how to buy the decryption tool from the racketeers. You can get this decoding tool after contacting via email. That is it.

Name	Sophos Virus
Ransomware family1	VoidCrypt ransomware
Extension	.[email].[victim id].Sophos
Ransomware note	Decrypt-me.txt
Contact	(may use different)
Detection2	MSIL/Spy.Agent.DSV, TrojanSpy:Win32/Delgent, Trojan.Ransom.Magniber
Symptoms	Your files (photos, videos, documents) have a .[email].[victim id].Sophos extension and you can’t open them.
Fix Tool	GridinSoft Anti-MalwareSee If Your System Has Been Affected by Sophos virus

The Decrypt-me.txt file accompanying the Sophos malware provides the following frustrating information:

All Your Files Has Been Encrypted
You Have to Pay to Get Your Files Back
1-Go to C:\\ProgramData\\ folder and send us prvkey*.txt.key file , * might be a number (like this : prvkey3.txt.key)
2-You can send some file little than 1mb for Decryption test to trust us But the test File should not contain valuable data
3-Payment should be with Bitcoin
4-Changing Windows without saving prvkey.txt.key file will cause permanete Data loss
Our Email:
in Case of no Answer:

In the image below, you can see what a directory with files encrypted by the Sophos looks like. Each filename has the “.[email].[victim id].Sophos” extension added to it.

That is how encrypted “.[email].[victim id].Sophos” files look.

How did Sophos ransomware end up on my PC?

There are currently three most exploited ways for evil-doers to have ransomware acting in your system. These are email spam, Trojan infiltration and peer-to-peer networks.

If you access your inbox and see letters that look just like notifications from utility services companies, delivery agencies like FedEx, web-access providers, and whatnot, but whose sender is unknown to you, beware of opening those emails. They are most likely to have a malware item enclosed in them. So it is even riskier to download any attachments that come with letters like these.

Another thing the hackers might try is a Trojan virus model³. A Trojan is an object that infiltrates into your PC disguised as something different. Imagine, you download an installer for some program you need or an update for some software. However, what is unboxed turns out to be a harmful agent that corrupts your data. As the update file can have any title and any icon, you’d better be sure that you can trust the resource of the stuff you’re downloading. The best thing is to use the software companies’ official websites.

As for the peer-to-peer networks like torrent trackers or eMule, the threat is that they are even more trust-based than the rest of the Web. You can never guess what you download until you get it. So you’d better be using trustworthy resources. Also, it is a good idea to scan the directory containing the downloaded objects with the anti-malware utility as soon as the downloading is complete.

How to remove the Sophos virus?

Often tamperers would decode few of your files so you know that they indeed have the decryption tool. Since Sophos virus is a relatively new ransomware, anti-malware developers have not yet found a way to undo its work. Nevertheless, the decryption tools are frequently upgraded, so the solution may soon arrive.

Of course, if the hackers do the job of encrypting someone’s critical data, the hopeless person will probably fulfill their demands. However, paying to criminals does not necessarily mean that you’re getting your files back. It is still dangerous. After obtaining the money, the racketeers may deliver a wrong decryption key to the victim. There were reports of criminals simply vanishing after getting the ransom without even bothering to reply.

The best countermeasure to ransomware is to have aan OS restore point or the copies of your critical files in the cloud storage or at least on an external disk. Surely, that might be insufficient. Your most important thing could be that one you were working on when it all went down. But at least it is something. It is also wise to scan your PC for viruses with the antivirus program after the OS is rolled back.

There are other ransomware products, besides Sophos, that work similarly. Examples of those are Wdlo, Kqgs, Bpqd, and some others. The two main differences between them and the Sophos are the ransom amount and the encoding method. The rest is almost identical: files become inaccessible, their extensions changed, ransom notes emerge in every folder containing encrypted files.

Some fortunate people were able to decrypt the blocked files with the help of the free software provided by anti-malware developers. Sometimes the racketeers accidentally send the decryption key to the wronged in the ransom note. Such an epic fail allows the injured part to restore the files. But obviously, one should never rely on such a chance. Make no mistake, ransomware is a tamperers’ technology to lay their hands on the money of their victims.

How do I avert ransomware attack?

You can protect your computer from ransomware injection within three easy steps:

• Ignore any emails from unknown mailers with strange addresses, or with content that has likely no connection to something you are waiting for (can you win in a lottery without participating in it?). In case the email subject is more or less something you are expecting, scrutinize all elements of the dubious email with caution. A fake email will always have a mistake.
• Do not use cracked or unknown programs. Trojans are often shared as a part of cracked software, possibly under the guise of “patch” preventing the license check. Understandably, dubious programs are difficult to distinguish from reliable software, because trojans sometimes have the functionality you need. You can try searching for information on this program on the anti-malware message boards, but the best solution is not to use such software.
• And to be sure about the safety of the objects you downloaded, use GridinSoft Anti-Malware. This program will be a powerful shield for your personal computer.

There is no better way to recognize, remove and prevent ransomware than to use an anti-malware software from GridinSoft">⁶.

Download Removal Tool.

You can download GridinSoft Anti-Malware by clicking the button below:

Download GridinSoft Anti-Malware

Run the setup file.

When setup file has finished downloading, double-click on the setup-antimalware-fix.exe file to install GridinSoft Anti-Malware on your computer.

An User Account Control asking you about to allow GridinSoft Anti-Malware to make changes to your device. So, you should click “Yes” to continue with the installation.

Press “Install” button.

Once installed, Anti-Malware will automatically run.

Wait for the Anti-Malware scan to complete.

GridinSoft Anti-Malware will automatically start scanning your PC for Sophos infections and other malicious programs. This process can take a 20-30 minutes, so I suggest you periodically check on the status of the scan process.

Click on “Clean Now”.

When the scan has finished, you will see the list of infections that GridinSoft Anti-Malware has detected. To remove them click on the “Clean Now” button in right corner.

Frequently Asked Questions

🤔 Can I somehow access “.[email].[victim id].Sophos” files?

There’s no way to do it, unless the files “.[email].[victim id].Sophos” files are decrypted.

🤔 What should I do to make my files accessible as fast as possible?

If the “.[email].[victim id].Sophos” files contain some really important information, then you probably have them backed up. In case you haven’t, there is still a chance that you do have a Restore Point from some time ago to roll back the whole system to the moment when it had no virus yet, but already had your files. There are other ways to beat ransomware, but they take time.

🤔 Will GridinSoft Anti-Malware remove all the encrypted files alongside the Sophos virus?

Of course not. Your encrypted files are no threat to your PC.

With the help of GridinSoft Anti-Malware, you can clean your system off the actual viruses. The ransomware that has attacked your device is must be still functional and it scans your system from time to time to encode any new files you might create on your computer after the initial attack. As it has been said above, the Sophos malware does not come alone. It installs backdoors and keyloggers that can take your account passwords by trespass and provide malefactors with easy access to your PC in the future.

🤔 What should I do if the Sophos malware has blocked my computer and I can’t get the activation key.

In such a case, you need to prepare a memory stick with a previously installed Trojan Killer. Use Safe Mode to execute the procedure. You see, the ransomware runs automatically as the system boots and encrypts any new files created or imported into your PC. To stop this process – use Safe Mode, which allows only the essential applications to run automatically. Consider reading our manual on running Windows in Safe Mode.

🤔 What could help the situation right now?

Some of the blocked data can be found elsewhere.

• If you exchanged your important files via email, you could still download them from your online mail server.
• You may have shared images or videos with your friends or family members. Simply ask them to send those pictures back to you.
• If you have initially downloaded any of your files from the Web, you can try downloading them again.
• Your messengers, social media pages, and cloud disks might have all those files as well.
• Maybe you still have the needed files on your old PC, a notebook, mobile, flash memory, etc.

USEFUL TIP: You can use data recovery utilities⁷ to get your lost data back since ransomware encodes the copies of your files, removing the authentic ones. In the video below, you can see how to use PhotoRec for such a restoration, but remember: you won’t be able to do it before you remove the virus with an antivirus program.

Also, you can contact the following governmental fraud and scam sites to report this attack:

• In the United States: On Guard Online;
• In Canada: Canadian Anti-Fraud Centre;
• In the United Kingdom: Action Fraud;
• In Australia: SCAMwatch;
• In New Zealand: Consumer Affairs Scams;
• In France: Agence nationale de la sécurité des systèmes d’information;
• In Germany: Bundesamt für Sicherheit in der Informationstechnik;
• In Ireland: An Garda Síochána;

To report the attack, you can contact local executive boards. For instance, if you live in USA, you can have a talk with FBI Local field office, IC3 or Secret Service.

References

1. My files are encrypted by ransomware, what should I do now?
2. Encyclopedia of threats.
3. You can read more on Trojans, their use and types in the Trojan-dedicated section of GridinSoft official website.
4. You can read more on spyware variants and nature in the respective section of GridinSoft official website.
5. GridinSoft Anti-Malware Review from HowToFix site:
6. More information about GridinSoft products:
7. Here are the top 10 file recovery tools of 2021.