Sext ransomware (Virus Removal Guide) - Recovery Instructions Included

Sext virus Removal Guide

What is Sext ransomware?

Sext ransomware – new cryptovirus demanding $600 worth of Bitcoins for the decryption tool

Sext ransomwareSext ransomware is a computer infection that renders your files useless until ransom of $600 is paid

Sext ransomware is a newly created cryptovirus that completely locks all personal files on the infected device. This virus encrypts all data with a very strong RSA algorithm[1]. All non-system files are appended with a .sext extension, hence the name of the ransomware. With this cryptovirus, a new lineage of LockDown ransomware family has been started.

After the Sext ransomware has finished encrypting files, it creates ransom notes, named HELP_DECRYPT_YOUR_FILES.txt. Within these notes, cybercriminals are reassuring the victims that they can retrieve their files, for a payment of $600. The ransom must be forwarded to the perpetrators in cryptocurrency Bitcoin to their crypto-wallet – 15zw6QrCbd5r8CD2eySMoTktstuEgD1Dzs. As in most ransomware, like FUSION or Termit, developers of this virus want to prove that they really do have the necessary decoding tool/key, and offer to send them one file for a test decryption. Victims are required to contact the criminals via email – with their unique assigned personal ID.

name Sext ransomware, .sext virus
type Malware, ransomware
family LockDown
appended extension .sext
ransom amount 600 USD is the asking price for the promised decryption tool/key
criminal BTC wallet 15zw6QrCbd5r8CD2eySMoTktstuEgD1Dzs
Criminal contact details
virus removal Reliable anti-virus software should be used to remove Sext ransomware
System fix Use a powerful FortectIntego tool after the sext virus removal to tune-up your system and avoid hazardous PC behavior

Based on statistics from[2], 55 out of 72 anti-virus engines detected this cryptovirus before it infected the computer systems. This shows the importance of reliable anti-malware software like Malwarebytes or SpyHunter 5Combo Cleaner. Use any of these apps to automatically and completely remove Sext ransomware from your contaminated device.

However, Sext ransomware removal won't decrypt your files. Nonetheless, it is still highly inadvisable to get in touch with the cybercriminals or even worse – complying with their demands. People not only lose their data but their money too. Experts[3] advise deleting the virus immediately and fixing any system settings and system file issues with a mighty system tune-up FortectIntego tool. Only then start restoring your data from backups and fully using your virus-free systems.

The whole criminal ransom note in files HELP_DECRYPT_YOUR_FILES.txt reads:

Oops All Of your important files were encrypted Like document pictures videos etc..

Don't worry, you can return all your files!
All your files, documents, photos, databases and other important files are encrypted by a strond encryption.

How to recover files?
RSA is a asymetric cryptographic algorithm, you need one key for encryption and one key for decryption so you
need private key to recover your files. It's not possible to recover files without private key.
The only method of recovering files is to purchase an unique private key. Only we can give you this key and only
we can recover your files.

What guarantees you have ?
As evidence, you can send us 1 file to decrypt by email We will send you a recovery file Prove that we can
decrypt your file

Please You must follow these steps carefully to decrypt your files:
Send $600 worth of bitcoin to wallet: 15zw6QrCbd5r8CD2eySMoTktstuEgD1Dzs
after payment ,we will send you Decryptor software
contact email:

Your personal ID:

Sext ransomware virusSext ransomware is a type of virus that specializes in money extortion

Techniques used by criminals to contaminate computers

Cybercriminals are trying really hard to outsmart everyday computer users, or catch them “sleeping”. They are using the same methods to spread their malicious creations for years now. People should be more careful while doing these things:

  • Opening any emails, especially from the spam folder. During spam campaigns, cybercriminals send out tens of thousands of emails with mischievous hyperlinks and infectious attachments. Never open phony looking hyperlinks. Always scan email attachments with a proper anti-virus app before opening or downloading them.
  • Visiting file-sharing platforms, like The Pirate Bay, BitTorrent, and others. A harmlessly looking crack (aka software illegal activation tool), or some game cheat codes, or anything else on those sites, might actually be malware in disguise. And right after it gets entry to a computer system it starts its dirty deeds.

To stay safe on the internet all users, no matter how tech-savvy, should always have their backs watched by some trustworthy anti-malware software.

Guidelines for Sext ransomware removal and system restore

As mentioned in the first paragraph, users should focus on this virus' elimination from the infected system. To remove Sext ransomware virus automatically, use Malwarebytes or SpyHunter 5Combo Cleaner antimalware apps. To stay safe in the future, remember to always keep these apps and their virus databases updated.

Sext files virusThe recovery of .sext files might be difficult if no backups are available

Once the Sext ransomware removal is finished, users can concentrate on rebuilding their computers. Not with a screwdriver, instead, use the FortectIntego tool to find out with a push of a button what the nasty virus has done to your system settings/files and reverse it.

do it now!
Fortect Happiness
Intego Happiness
Compatible with Microsoft Windows Compatible with macOS
What to do if failed?
If you failed to fix virus damage using Fortect Intego, submit a question to our support team and provide as much details as possible.
Fortect Intego has a free limited scanner. Fortect Intego offers more through scan when you purchase its full version. When free scanner detects issues, you can fix them using free manual repairs or you can decide to purchase the full version in order to fix them automatically.
Alternative Software
Different software has a different purpose. If you didn’t succeed in fixing corrupted files with Fortect, try running SpyHunter 5.
Alternative Software
Different software has a different purpose. If you didn’t succeed in fixing corrupted files with Intego, try running Combo Cleaner.

Getting rid of Sext virus. Follow these steps

Manual removal using Safe Mode

In case the Sext ransomware virus is tampering with your anti-malware software, enter Safe Mode with Networking and perform a full system scan from there:

Important! →
Manual removal guide might be too complicated for regular computer users. It requires advanced IT knowledge to be performed correctly (if vital system files are removed or damaged, it might result in full Windows compromise), and it also might take hours to complete. Therefore, we highly advise using the automatic method provided above instead.

Step 1. Access Safe Mode with Networking

Manual malware removal should be best performed in the Safe Mode environment. 

Windows 7 / Vista / XP
  1. Click Start > Shutdown > Restart > OK.
  2. When your computer becomes active, start pressing F8 button (if that does not work, try F2, F12, Del, etc. – it all depends on your motherboard model) multiple times until you see the Advanced Boot Options window.
  3. Select Safe Mode with Networking from the list. Windows 7/XP
Windows 10 / Windows 8
  1. Right-click on Start button and select Settings.
  2. Scroll down to pick Update & Security.
    Update and security
  3. On the left side of the window, pick Recovery.
  4. Now scroll down to find Advanced Startup section.
  5. Click Restart now.
  6. Select Troubleshoot. Choose an option
  7. Go to Advanced options. Advanced options
  8. Select Startup Settings. Startup settings
  9. Press Restart.
  10. Now press 5 or click 5) Enable Safe Mode with Networking. Enable safe mode

Step 2. Shut down suspicious processes

Windows Task Manager is a useful tool that shows all the processes running in the background. If malware is running a process, you need to shut it down:

  1. Press Ctrl + Shift + Esc on your keyboard to open Windows Task Manager.
  2. Click on More details.
    Open task manager
  3. Scroll down to Background processes section, and look for anything suspicious.
  4. Right-click and select Open file location.
    Open file location
  5. Go back to the process, right-click and pick End Task.
    End task
  6. Delete the contents of the malicious folder.

Step 3. Check program Startup

  1. Press Ctrl + Shift + Esc on your keyboard to open Windows Task Manager.
  2. Go to Startup tab.
  3. Right-click on the suspicious program and pick Disable.

Step 4. Delete virus files

Malware-related files can be found in various places within your computer. Here are instructions that could help you find them:

  1. Type in Disk Cleanup in Windows search and press Enter.
    Disk cleanup
  2. Select the drive you want to clean (C: is your main drive by default and is likely to be the one that has malicious files in).
  3. Scroll through the Files to delete list and select the following:

    Temporary Internet Files
    Recycle Bin
    Temporary files

  4. Pick Clean up system files.
    Delete temp files
  5. You can also look for other malicious files hidden in the following folders (type these entries in Windows Search and press Enter):


After you are finished, reboot the PC in normal mode.

Remove Sext using System Restore

System restore might be of use when trying to deal with malware infection:

  • Step 1: Reboot your computer to Safe Mode with Command Prompt
    Windows 7 / Vista / XP
    1. Click Start Shutdown Restart OK.
    2. When your computer becomes active, start pressing F8 multiple times until you see the Advanced Boot Options window.
    3. Select Command Prompt from the list Select 'Safe Mode with Command Prompt'

    Windows 10 / Windows 8
    1. Press the Power button at the Windows login screen. Now press and hold Shift, which is on your keyboard, and click Restart..
    2. Now select Troubleshoot Advanced options Startup Settings and finally press Restart.
    3. Once your computer becomes active, select Enable Safe Mode with Command Prompt in Startup Settings window. Select 'Enable Safe Mode with Command Prompt'
  • Step 2: Restore your system files and settings
    1. Once the Command Prompt window shows up, enter cd restore and click Enter. Enter 'cd restore' without quotes and press 'Enter'
    2. Now type rstrui.exe and press Enter again.. Enter 'rstrui.exe' without quotes and press 'Enter'
    3. When a new window shows up, click Next and select your restore point that is prior the infiltration of Sext. After doing that, click Next. When 'System Restore' window shows up, select 'Next' Select your restore point and click 'Next'
    4. Now click Yes to start system restore. Click 'Yes' and start system restore
    Once you restore your system to a previous date, download and scan your computer with FortectIntego and make sure that Sext removal is performed successfully.

Bonus: Recover your data

Guide which is presented above is supposed to help you remove Sext from your computer. To recover your encrypted files, we recommend using a detailed guide prepared by security experts.

If your files are encrypted by Sext, you can use several methods to restore them:

Make use of Data Recovery Pro

Data Recovery Pro is designed to recover files that were accidentally deleted or lost due to hard drive wipe. However, the program also proved to be useful for some ransomware victims.

  • Download Data Recovery Pro;
  • Follow the steps of Data Recovery Setup and install the program on your computer;
  • Launch it and scan your computer for files encrypted by Sext ransomware;
  • Restore them.

When attempting to recover from a ransomware attack, try Windows Previous versions

This method might be useful if malware did not delete Shadow Copies, and you had the System Restore feature enabled.

  • Find an encrypted file you need to restore and right-click on it;
  • Select “Properties” and go to “Previous versions” tab;
  • Here, check each of available copies of the file in “Folder versions”. You should select the version you want to recover and click “Restore”.

ShadowExplorer can automate data recovery process

If the virus did not perform its actions correctly, ShadowExplorer should be able to help you.

  • Download Shadow Explorer (;
  • Follow a Shadow Explorer Setup Wizard and install this application on your computer;
  • Launch the program and go through the drop down menu on the top left corner to select the disk of your encrypted data. Check what folders are there;
  • Right-click on the folder you want to restore and select “Export”. You can also select where you want it to be stored.

No decryptor is is currently available

Finally, you should always think about the protection of crypto-ransomwares. In order to protect your computer from Sext and other ransomwares, use a reputable anti-spyware, such as FortectIntego, SpyHunter 5Combo Cleaner or Malwarebytes

How to prevent from getting ransomware

Stream videos without limitations, no matter where you are

There are multiple parties that could find out almost anything about you by checking your online activity. While this is highly unlikely, advertisers and tech companies are constantly tracking you online. The first step to privacy should be a secure browser that focuses on tracker reduction to a minimum.

Even if you employ a secure browser, you will not be able to access websites that are restricted due to local government laws or other reasons. In other words, you may not be able to stream Disney+ or US-based Netflix in some countries. To bypass these restrictions, you can employ a powerful Private Internet Access VPN, which provides dedicated servers for torrenting and streaming, not slowing you down in the process.

Data backups are important – recover your lost files

Ransomware is one of the biggest threats to personal data. Once it is executed on a machine, it launches a sophisticated encryption algorithm that locks all your files, although it does not destroy them. The most common misconception is that anti-malware software can return files to their previous states. This is not true, however, and data remains locked after the malicious payload is deleted.

While regular data backups are the only secure method to recover your files after a ransomware attack, tools such as Data Recovery Pro can also be effective and restore at least some of your lost data.

About the author
Jake Doevan
Jake Doevan - Computer technology expert

If this free guide helped you and you are satisfied with our service, please consider making a donation to keep this service alive. Even a smallest amount will be appreciated.

Contact Jake Doevan
About the company Esolutions