How to remove JabaCrypter ransomware

JabaCrypter ransomware is a virus that renders most personal files unusable

JabaCrypter ransomware is a deadly crypto-virus designed to encrypt all users files using AES^[1] cipher and demand ransom for their release. As soon as the virus executes its payload and secures its presence, it locks up all files on the machine by appending .cryptfile extension. Additionally, it drops ransom note called ReadMe.html (ПРОЧТИ МЕНЯ.html).

A JabaCrypter virus was first discovered late April 2018. This cyber threat targets Russian speaking users, as the note is written in Russian. However, it does not mean that further versions will not be translated into English to be understood by a broader audience.

The virus typically enters users machines via contaminated attachments in spam emails, repacked installers, fake updates, etc. As soon as JabaCrypter ransomware executes its payload, it strengthens its presence by modifying PC settings, which guarantees its boot up with every computer restart.

Then, it encrypts personal media, MS Office docs, PDF, text and similar files. For example, a file that was called picture.jpg before encryption will be turned into picture.jpg.cryptfile. This makes the data unusable as it requires a decryption key stored on a remote server by cybercriminals. The first thing that should be done, however, is JabaCrypter removal.

The ransom note displays the following message (translated to English):

Report: All your files are successfully encrypted.
Without panic, Ladies and Gentlemen!
———————————–
All your files and databases are successfully encrypted by our sly-ass cryptor.
Deciphering all your goods without having a unique “decryptor” is virtually impossible !, you simply destroy all your data.
If you are not greedy, but a very generous person, then we are ready to exchange all your precious information for pathetic paper called bucks.
Believe me, the loot wins the evil, give it to us.
———————————–
On the acquisition of “decryptor” write to the mail: jabanenok@gmail.com
In the letter – do not forget to indicate your “id” specified at the end of each encrypted file.
We will decrypt  for free several of your files, so that you can make sure that we have the decoder, maybe he will be by you.
———————————–
© 2018 Everything will be fine!

The hackers are urging users to contact them via the email jabanenok@gmail.com as soon as the payment in Bitcoin is completed. Victims are notified of the amount in the email.

Regardless if the asked payment is low, users should never contact JabaCrypter authors because there is no guarantee that files will be saved. Oftentimes, users might be sent an executable file which is malware that can damage PCs even further.

Thus, the best course of action would be to remove JabaCrypter ransomware immediately and then proceed with file recovery. As the virus is complicated, users should not attempt manual elimination. Instead, they should download and install FortectIntego, SpyHunterCombo Cleaner or MalwarebytesMalwarebytes. These programs are designed to deal even with the most persistent malware.

As soon as JabaCrypter virus is deleted, users can proceed with file recovery. Unfortunately, the only safe way to restore all files is by getting them back from a remote server, such as an external HDD drive or a cloud server. Nevertheless, there is a possibility to recover the data without the backup. Please read further to find out how.

Dangerous ransomware reaches targeted computers via spam emails

If you carelessly open all emails that come your way, you are at high risk of malware infection. Malicious file attachments in spam emails might contain trojan horses or ransomware. Thus, it is extremely important never to let your guard down and be attentive while checking your inbox.

Security experts^[2] advise users to ignore emails from unknown sources entirely. Nevertheless, it is not always possible. Hence, you can undertake other precautions:

• Learn to spot a phishing email^[3] – check for spelling mistakes, original “From” address, etc.;
• Contact the company or institution the email is from and ask them if it is legitimate;
• Do not ignore emails that were marked by the built-in security software of your email provider and delete them without peeking inside.

Additionally, users are advised avoid websites of dubious content, especially file-sharing and peer-to-peer sites.

Eliminate JabaCrypter automatically

As we already mentioned, ransomware infection is a severe threat as it can permanently delete all your files. Thus, manual JabaCrypter removal is not recommended.

Instead, download and install a powerful security tool which takes care of everything automatically. Do not forget that the virus might prevent your anti-virus from starting correctly. Thus, boot up your PC in Safe Mode with Networking as explained below.

Remember, you need to remove JabaCrypter virus before attempting data recovery. Otherwise, your files will be contaminated again.