JoJoCrypt Ransomware - How to remove

JoJoCrypt is a malicious program, file-encrypting ransomware. It breaks files, including documents, images, music, etc. It’s very possible that other malware is installed with JoJoCrypt, too. All of this malicious software needs to be deleted. Unfortunately, this doesn’t fix the broken files and there’s currently no simple way to restore the data that was broken by the ransomware.

About JoJoCrypt ransomware:

Threat type	Ransomware, trojan.
Symptoms of a JoJoCrypt infection	Files don’t open and their names are changed to include the phrase “jojocrypt”, ransom notes are left behind with the contact info of the criminals.
How to recover the data lost to the ransomware	Restore files from backups, use data recovery tools to bring back deleted files.
How to get rid of JoJoCrypt and other malware	Find and delete malicious items with antivirus tools (Spyhunter, others).

Did JoJoCrypt ransomware infect your computer?

JoJoCrypt is ransomware – a malicious program that locks your data and holds it for ransom. It works by, essentially, password-locking your files. The people behind this ransomware ask for money in exchange for giving you the password to your data.

JoJoCrypt uses cryptography to lock the files on the infected computer. The locked files have their internal contents scrambled. They’re impossible to fix without the decryption key that the criminals are holding.

Here is how you can recognize JoJoCrypt ransomware:

• It changes the name/file type of the files that it encrypted. It adds “jojocrypt” to the name of each file.
• It creates a ransom note called “how to recover your files.txt”.
• In the ransom note, the cybercriminals behind JoJoCrypt provide their contact details ([email protected]).

Antivirus tools detect JoJoCrypt with labels such as Ransom, Malicious, Malware, Unsafe, and Trojan – see Virustotal.com.

Common ways in which ransomware spreads

Since JoJoCrypt appears to be new, there’s no yet much known about how it infects computers. Here are some common ways in which ransomware spreads:

• Malicious emails. Files that download ransomware (and other malware) are attached to or linked in spam emails. Those emails could be disguised as job applications, invoices, parcel notices, documents from work, and other mundane messages.
• RDP and VPN hacks. Cybercriminals target remote access points that have exploitable bugs or use weak credentials.
• Files embedded in free – usually, pirated – software. Pirated programs, games, and even media can be infected with malware. (This is how Djvu, one of the most popular ransomware viruses, spreads.)
• Malicious advertisements and redirect in infected websites.

How to delete JoJoCrypt and restore your files

Recover the data locked by JoJoCrypt

Ransomware experts have already looked at JoJoCrypt. Unfortunately, there’s currently no way to repair the files that were encrypted by this ransomware. And there might never be a free decryptor.

There are some other options for data recovery:

• Restoring data from backups. If you had backups before JoJoCrypt attacked, you can bring your data back. Even if you didn’t intentionally set up backups, you might have uploaded some of your files online.
• Using file recovery tools. Some programs, like EaseUS, can bring back deleted files, which might include valuable data.

Equally important is to know what to avoid:

• Don’t contact the cybercriminals behind JoJoCrypt ransomware unless you absolutely have to. Protect your anonymity. Expect technical difficulties and scammy behavior from the cybercriminals.
• Don’t pool the ransom payment with the other victims of JoJoCrypt ransomware. The decryption keys are unique to each victim and are not shared.
• Don’t trust anyone who promises to fix all of the files that were locked by JoJoCrypt for a fee. Ask for evidence every step of the way and don’t pay unless you’re certain that you’re not being scammed.

Remove all malware

But first, it’s important to delete all malware from your device. That includes JoJoCrypt ransomware, as well as other malicious programs that might have come with it. It is not uncommon for ransomware to be installed together with spyware, adware, and other malicious programs.

You can use antivirus tools, such as Spyhunter, to detect and delete infections.

If your antivirus scan detected spyware trojans, it’s also very important to change your passwords and make sure that you’re using 2-factor authentication wherever possible. This will prevent cybercriminals from stealing your online accounts.

Automatic Malware removal tools

How to recover JoJoCrypt Ransomware encrypted files and remove the virus

Step 1. Restore system into last known good state using system restore

1. Reboot your computer to Safe Mode with Command Prompt:

for Windows 7 / Vista/ XP

• Start → Shutdown → Restart → OK.
• Press F8 key repeatedly until Advanced Boot Options window appears.
• Choose Safe Mode with Command Prompt.

for Windows 8 / 10

• Press Power at Windows login screen. Then press and hold Shift key and click Restart.
• Choose Troubleshoot → Advanced Options → Startup Settings and click Restart.
• When it loads, select Enable Safe Mode with Command Prompt from the list of Startup Settings.

 

2.Restore System files and settings.

• When Command Prompt mode loads, enter cd restore and press Enter.
• Then enter rstrui.exe and press Enter again.
• Click “Next” in the windows that appeared.
• Select one of the Restore Points that are available before JoJoCrypt Ransomware has infiltrated to your system and then click “Next”.
• To start System restore click “Yes”.

 

Step 2. Complete removal of JoJoCrypt Ransomware

After restoring your system, it is recommended to scan your computer with an anti-malware program, like Spyhunter and remove all malicious files related to JoJoCrypt Ransomware. You can check other tools here.  

Step 3. Restore JoJoCrypt Ransomware affected files using Shadow Volume Copies

If you do not use System Restore option on your operating system, there is a chance to use shadow copy snapshots. They store copies of your files that point of time when the system restore snapshot was created. Usually JoJoCrypt Ransomware tries to delete all possible Shadow Volume Copies, so this methods may not work on all computers. However, it may fail to do so. Shadow Volume Copies are only available with Windows XP Service Pack 2, Windows Vista, Windows 7, and Windows 8. There are two ways to retrieve your files via Shadow Volume Copy. You can do it using native Windows Previous Versions or via Shadow Explorer. a) Native Windows Previous Versions Right-click on an encrypted file and select Properties → Previous versions tab. Now you will see all available copies of that particular file and the time when it was stored in a Shadow Volume Copy. Choose the version of the file you want to retrieve and click Copy if you want to save it to some directory of your own, or Restore if you want to replace existing, encrypted file. If you want to see the content of file first, just click Open.

b) Shadow Explorer It is a program that can be found online for free. You can download either a full or a portable version of Shadow Explorer. Open the program. On the left top corner select the drive where the file you are looking for is a stored. You will see all folders on that drive. To retrieve a whole folder, right-click on it and select “Export”. Then choose where you want it to be stored.

Step 4. Use Data Recovery programs to recover JoJoCrypt Ransomware encrypted files

There are several data recovery programs that might recover encrypted files as well. This does not work in all cases but you can try this:

• We suggest using another PC and connect the infected hard drive as slave. It is still possible to do this on infected PC though.
• Download a data recovery program.
• Install and scan for recently deleted files.

Note: In many cases it is impossible to restore data files affected by modern ransomware. Thus I recommend using decent cloud backup software as precaution. We recommend checking out Carbonite, BackBlaze, CrashPlan or Mozy Home.