How to remove Omnisphere ransomware and decrypt .omnisphere files

Ominisphere ransomware encryption process

Omnisphere is a new type of file-encrypting ransomware, the aim of which, as it can be understood, is to make you pay for the restoring of the encrypted files. The process of infection with this ransomware can hardly be noticed, as hackers usually injects this malicious code into email attachments, installators and even create fake software. Moreover, hackers can inject this virus directly with the help of brute forcing of open ports. Once Omnisphere is injected into a system, it begins the encryption process, that we can divide into two parts: it seeks for the appropriate files (it can be documents of different extensions, like .doc and media files, like .jpg ones) and then the virus changes the structure of them. As the result your files are unreadable, as the virus has changed the extensions of your files to .omnisphere ones. Don’t try to remove Omnisphere ransomware encryption by the manual ways, as it may damage your files without a possibility of restoring them. Moreover, the virus creates a special ransom note, that is called !DECRYPT_MY_FILE_OS.txt and it contains the following information:

## OmniSphere ransomware ##
----
Y0UR PERS0NAL FILES, PHOTOS, DATABASES ARE ENCRYPTED!
If you want return all files, read this instruction
----
The only way to decrypt your files is to receive the private key and decryption program
Private decryption key is stored on a secret server and nobody can decrypt your files
until you pay and obtain the private key
----
To obtain the private key for this computer find special file (unique_decrypt.key)
(You can find this file in any encrypted folder)
If you found this file please, follow instruction below for DECRYPT ALL YOUR FILES:
----
1. Download Tor Browser https://www.torproject.org/download/ and install.
2. Open Tor Browser
3. In Tor Browser open personal page here:
http://uu6issmbncd3wjkm.onion/46HFJZEAPF3JKNLU
4. When personal page open, click on browse button and upload unique_decrypt.key file
5. Follow instruction on personal page
Note! This page is available via Tor Browser only!

Think twice before you pay them, as they don’t give you any firm guarantee. It’s a great risk and you can easily become deceived. Moreover, they will renew this virus and create new ones till they are getting paid for it and persons, who have already payed for the decryption, are potential aims for a new attack. If you wonder how to remove Omnisphere ransomware and decrypt .omnisphere files, you can use our guide for free!

---

Article’s Guide

1. How to remove Omnisphere Ransomware from your computer
2. How to remove Omnisphere Ransomware encryption from your files
3. Data Recovery
4. Automated decryption tools
5. Windows Previous Versions

---

How to remove Omnisphere Ransomware from your computer?

We strongly recommend you to use a powerful anti-malware program that has this threat in its database. It will mitigate the risks of the wrong installation, and will remove Omnisphere from your computer with all of its leftovers and register files.

Solution for Windows users: our choice is Norton 360 . Norton 360 scans your computer and detects various threats like Omnisphere, then removes it with all of the related malicious files, folders and registry keys.

Download Norton

If you are Mac user, we advise you to use Combo Cleaner.

---

How to decrypt .omnisphere files?

Once you’ve removed the virus, you are probably thinking how to decrypt .omnisphere files. Let’s take a look at possible ways of decrypting your data.

Recover data with Data Recovery

1. Download and install Data Recovery
2. Select drives and folders with your files, then click Scan.
3. Choose all the files in a folder, then press on Restore button.
4. Manage export location.

Download Stellar Data Recovery

_{The download is an evaluation version for recovering files. To unlock all features and tools, purchase is required ($49.99-299). By clicking the button you agree to EULA and Privacy Policy. Downloading will start automatically.}

---

Restore data with automated decryption tools

Unfortunately, due to the novelty of Omnisphere ransomware, there are no available automatic decryptors for this encryptor yet. Still, there is no need to invest in the malicious scheme by paying a ransom. You are able to recover files manually.
You can try to use one of these methods in order to restore your encrypted data manually.

Restore data with Windows Previous Versions

This feature is working on Windows Vista (not Home version), Windows 7 and later versions. Windows keeps copies of files and folders which you can use to restore data on your computer. In order to restore data from Windows Backup, take the following steps:

1. Open My Computer and search for the folders you want to restore;
2. Right-click on the folder and choose Restore previous versions option;
3. The option will show you the list of all the previous copies of the folder;
4. Select restore date and the option you need: Open, Copy and Restore.