How to remove Sepsis ransomware

Sepsis ransomware is a decryptable virus that demands ransom

Sepsis ransomware^[1] is a file-encrypting virus that uses difficult algorithms for the data modification. This virus adds .[Sepsis@protonmail.com].SEPSIS file extension to prevent people from accessing their files. Once all files are locked, malware places Info.hta file on every existing folder. It is a ransom message that contains information regarding this attack, such as ransom amount, contact emails and other information about file decryption. However, there's no need to pay attention to these details. In June 2018, researchers cracked ransomware's code and created a decryption tool to help victims.

Sepsis virus seems to be spread via malicious spam emails that include an infected attachment. When a user opens it, the virus payload is dropped on the system.^[2] Malware immediately makes system changes and installs its malicious components.

As soon as Sepsis malware settles down on Windows machine, it starts scanning the system looking for the files to encrypt. The malicious program is designed to lock the most popular files in order to cause bigger damage and motivate victims to pay the ransom. However, cyber criminals do not tell the specific price for the decryption.

In the Info.hta file delivered once all files are encrypted by Sepsis ransomware, criminals only tell about a necessity to write an email to sepsis@prontomail.com or sepsis@airmail.cc and write their victim ID number. However, crooks encourage victims to rush if they want to pay less for the decryption:

The price depends on how fast you write to us. You have to pay for decryption in Bitcoins. After payment we will send you the decryption tool that will decrypt all your files.

Authors of Sepsis ransomware want to prove doubting victims and offer to decrypt up to 5 files for free which are not bigger than 10 Mb. However, these files might be the only one that you can retrieve. Once they receive your payment, they might disappear and “forget” to send you a decryptor.

Ransomware business is based on collecting ransoms. Data recovery is just the matter of hackers’ conscience, and we doubt that they have much of it. After the attack, we highly recommend focusing on Sepsis ransomware removal instead of paying several hundreds of dollars for a risky decryption method.

June 2018 came bearing the decryption tool for Sepsis ransomware. Computer engineer, IT enthusiast Francesco Muroni cracked the code and delivered decryption tool for the virus. This tool can recover your files, but you can use it only when the system is cleaned from malware-related components. File decryption and recovery might be useless if you have not removed all remaining parts of the virus yet.

To remove Sepsis ransomware virus from the computer you will need to obtain a reputable anti-malware software. We recommend using FortectIntego or SpyHunterCombo Cleaner for this job. However, you can use any other updated and professional program. More information about the removal and how to use the official decryptor is given at the end of this article. 

Insecure spam emails can spread ransomware easily

Malspam is the common way to spread file-encrypting viruses. Malware executable is obfuscated and included in an email attachment. This file typically looks like ordinary Word or ZIP file; however, once opened it downloads malware executable on the system.

For this reason, users are advised to be attentive with received emails:

• avoid opening spam;
• check the information about the sender;
• double-check credentials online;
• look up for grammar, spelling or use of language mistakes;
• scan the attachment with online scanners.

Security specialists from bedynet.ru^[3] also remind that ransomware might hide in fake update pop-ups, illegal downloads, and other questionable digital content. Hence, it’s recommended to avoid high-risk places of the internet and keep security program updated on your PC.

You can eliminate Sepsis ransomware and recover corrupted files now

Sepsis ransomware removal requires scanning the infected machine with malware removal programs. FortectIntego, MalwarebytesMalwarebytes or other professional tools should quickly detect and eliminate all malicious components. However, if malware blocks automatic elimination, you should follow the guide below to get rid of all the obstacles.

Once you remove Sepsis ransomware from the computer, you can restore your files from backups. Other recovery methods might not work at the moment. Malware researchers haven’t created a decryptor yet. However, you can try using other options presented below. Hopefully, you will manage to get back at least some of the lost data.