SOPHOS Ransomware (.Sophos Files) — How to remove?

The Sophos virus falls under the VoidCrypt ransomware family. Harmful software of such sort encrypts all the data on your PC (images, text files, excel sheets, music, videos, etc) and appends its specific extension to every file, leaving the Decrypt-me.txt text files in each folder with the encrypted files.

This ransomware uses the same name as the famous cybersecurity vendor – Sophos Group. It has a lot of different products related to cybersecurity, and when you google “Sophos ransomware”, you will likely get the results with articles from this vendor about the ransomware threat. To find the sites related to the same-named ransomware, you must open the second or even the third page. Such a tricky way to hide the solutions from users is not new.

What is known about the Sophosvirus?

☝️ A scientifically correct description for the Sophos would be “a VoidCrypt family ransomware-type malicious agent”.

The pattern of renaming is the following: [email].[victim id].Sophos. In the process of encryption, a file entitled, for example, “report.docx” will be turned into “report.docx.[[email protected]][ZRDUT4AGKS5CVM7].Sophos”.

In every directory with the encoded files, a Decrypt-me.txt text file will be created. It is a ransom money memo. Therein you can find information about the ways of paying the ransom and some other information. The ransom note most probably contains a description of how to buy the decryption tool from the racketeers. You can get this decoding tool after contacting [email protected] via email. That is it.

Sophos abstract:

The Decrypt-me.txt file accompanying the Sophos malware provides the following frustrating information:

All Your Files Has Been Encrypted

You Have to Pay to Get Your Files Back

1-Go to C:\\ProgramData\\  folder  and send us prvkey*.txt.key  file ,  *  might be a number (like this : prvkey3.txt.key)

2-You can send some file little than 1mb for Decryption test to trust us But the test File should not contain valuable data

3-Payment should be with Bitcoin


4-Changing Windows without saving prvkey.txt.key file will cause permanete Data loss


Our Email:[email protected]

in Case of no Answer:[email protected]

In the image below, you can see what a directory with files encrypted by the Sophos looks like. Each filename has the “.[email].[victim id].Sophos” extension added to it.

How did Sophos ransomware end up on my PC?

There are plenty of possible ways of ransomware infiltration.

There are currently three most exploited ways for evil-doers to have ransomware acting in your system. These are email spam, Trojan infiltration and peer-to-peer networks.

If you access your inbox and see letters that look just like notifications from utility services companies, delivery agencies like FedEx, web-access providers, and whatnot, but whose sender is unknown to you, beware of opening those emails. They are most likely to have a malware item enclosed in them. So it is even riskier to download any attachments that come with letters like these.

As for the peer-to-peer networks like torrent trackers or eMule, the threat is that they are even more trust-based than the rest of the Web. You can never guess what you download until you get it. So you’d better be using trustworthy resources. Also, it is a good idea to scan the directory containing the downloaded objects with the anti-malware utility as soon as the downloading is complete.

How to remove the Sophos virus?

It is important to note that besides encrypting your files, the Sophos virus will probably install the Azorult Spyware on your PC to get access to credentials to different accounts (including cryptocurrency wallets). The mentioned spyware³ can extract your logins and passwords from your browser’s auto-filling cardfile.

Often tamperers would decode few of your files so you know that they indeed have the decryption tool. Since Sophos virus is a relatively new ransomware, anti-malware developers have not yet found a way to undo its work. Nevertheless, the decryption tools are frequently upgraded, so the solution may soon arrive.

Of course, if the hackers do the job of encrypting someone’s critical data, the hopeless person will probably fulfill their demands. However, paying to criminals does not necessarily mean that you’re getting your files back. It is still dangerous. After obtaining the money, the racketeers may deliver a wrong decryption key to the victim. There were reports of criminals simply vanishing after getting the ransom without even bothering to reply.

The best countermeasure to ransomware is to have aan OS restore point or the copies of your critical files in the cloud storage or at least on an external disk. Surely, that might be insufficient. Your most important thing could be that one you were working on when it all went down. But at least it is something. It is also wise to scan your PC for viruses with the antivirus program after the OS is rolled back.

There are other ransomware products, besides Sophos, that work similarly. Examples of those are Wdlo, Kqgs, Bpqd, and some others. The two main differences between them and the Sophos are the ransom amount and the encoding method. The rest is almost identical: files become inaccessible, their extensions changed, ransom notes emerge in every folder containing encrypted files.

Some fortunate people were able to decrypt the blocked files with the help of the free software provided by anti-malware developers. Sometimes the racketeers accidentally send the decryption key to the wronged in the ransom note. Such an epic fail allows the injured part to restore the files. But obviously, one should never rely on such a chance. Make no mistake, ransomware is a tamperers’ technology to lay their hands on the money of their victims.

How do I avert ransomware attack?

Sophos ransomware doesn’t have a superpower, neither does any similar malware.

You can protect your computer from ransomware injection within three easy steps:

• Ignore any emails from unknown mailers with strange addresses, or with content that has likely no connection to something you are waiting for (can you win in a lottery without participating in it?). In case the email subject is more or less something you are expecting, scrutinize all elements of the dubious email with caution. A fake email will always have a mistake.
• Do not use cracked or unknown programs. Trojans are often shared as a part of cracked software, possibly under the guise of “patch” preventing the license check. Understandably, dubious programs are difficult to distinguish from reliable software, because trojans sometimes have the functionality you need. You can try searching for information on this program on the anti-malware message boards, but the best solution is not to use such software.

Reasons why I would recommend GridinSoft⁴

Download Removal Tool.

Run the setup file.

Press “Install” button.

Once installed, Anti-Malware will automatically run.

Wait for the Anti-Malware scan to complete.

Click on “Clean Now”.

Frequently Asked Questions

🤔 Can I somehow access “.[email].[victim id].Sophos” files?

There’s no way to do it, unless the files “.[email].[victim id].Sophos” files are decrypted.

🤔 What should I do to make my files accessible as fast as possible?

If the “.[email].[victim id].Sophos” files contain some really important information, then you probably have them backed up. In case you haven’t, there is still a chance that you do have a Restore Point from some time ago to roll back the whole system to the moment when it had no virus yet, but already had your files. There are other ways to beat ransomware, but they take time.

🤔 What should I do if the Sophos malware has blocked my computer and I can’t get the activation key.

🤔 What could help the situation right now?

Some of the blocked data can be found elsewhere.

• If you exchanged your important files via email, you could still download them from your online mail server.
• You may have shared images or videos with your friends or family members. Simply ask them to send those pictures back to you.
• If you have initially downloaded any of your files from the Web, you can try downloading them again.
• Your messengers, social media pages, and cloud disks might have all those files as well.
• Maybe you still have the needed files on your old PC, a notebook, mobile, flash memory, etc.

USEFUL TIP: You can use data recovery utilities⁶ to get your lost data back since ransomware encodes the copies of your files, removing the authentic ones. In the video below, you can see how to use PhotoRec for such a restoration, but remember: you won’t be able to do it before you remove the virus with an antivirus program.

Also, you can contact the following governmental fraud and scam sites to report this attack:

• In the United States: On Guard Online;
• In Canada: Canadian Anti-Fraud Centre;
• In the United Kingdom: Action Fraud;
• In Australia: SCAMwatch;
• In New Zealand: Consumer Affairs Scams;
• In France: Agence nationale de la sécurité des systèmes d’information;
• In Germany: Bundesamt für Sicherheit in der Informationstechnik;
• In Ireland: An Garda Síochána;

To report the attack, you can contact local executive boards. For instance, if you live in USA, you can have a talk with FBI Local field office, IC3 or Secret Service.

1. My files are encrypted by ransomware, what should I do now?
2. Here are Top 10 Data Recovery Software Of 2023.