How to remove Jemd ransomware

Jemd ransomware is a crypto virus that is usually distributed with the help of malicious spam email attachments

Jemd ransomware is a file locking malware that was first spotted by the independent security researcher GrujaRS^[1] on December 16th, 2018. It uses AES^[2] encryption algorithm to lock up files and then demands a ransom to be paid in Bitcoin cryptocurrency. Jemd virus stems from DelphiRansomware which is a relatively new infection, discovered just a month ago. It is unknown what type of extension the malware uses to encrypt data, but users can view Recovery.txt file that explains victims that they have to contact hackers via the rezko@prottykon.mit.edu email address. Fortunately, a relatively weak script has multiple flaws, and users can fully recover their data via System Restore feature.

According to VirusTotal analysis, 30 AV engines detect Jemd ransomware. Therefore, we suggest you use FortectIntego security software (based on Avira engine) to block the incoming infection. Because the malicious file is detected, Jemd ransomware removal can also be performed with the mentioned security software.

Jemd virus is usually propagated using the following methods:

• Spam emails;
• Exploit kits;^[3]
• Software vulnerabilities;
• Brute-force attacks;
• Infected installers;
• Torrent files;
• Fake updates, etc.

There are several ways you could prevent the infiltration of the cyber threat, and we explain it in the second section of the article. Nevertheless, if your machine is infected, you will have to remove Jemd ransomware from your PC before proceeding with file recovery procedure.

The safest way to retrieve encrypted data is by using backups that were made before the infection occurred. Unfortunately, not all people actually do backups and end up regretting the decision. However, according to a Twitter post, users can restore all their files by performing System Restore, as the ransomware has several bugs in it. Additionally, victims can try using third-party software that could help with data recovery.

Here's what the ransom note Recovery.txt states:

<><><><><><>jemd<><><><><><>
All your files were encrypted by jemd.
Used a AES encryption.
AES a best algorytm. If you – gruja, decryption inpossible
Contact us: rezko@prottykon.mit.edu 
<><><><><><>jemd<><><><><><>
Personal id:

While some users might consider contacting hackers, experts^[4] agree that it is not a wise decision to make. First of all, there is no guarantee that crooks will send the decryption key back, so money loss is probable. Additionally, paying criminals will only encourage them to perform illegal acts in the future.

Avoid ransomware by being careful online

As we already mentioned, there are several different ways ransomware can infiltrate machines. While in some cases cybercrooks choose social engineering and deception to install the malware, in other cases they rely on users who are using weak passwords or unpatched systems. 

There are several precautionary measures you can practice. Of course, no method is 100% secure, but following these tips will reduce the chance of infection significantly:

• Install reputable security software with real-time scanning feature;
• Use strong passwords for all your accounts (we suggest using password manager) and protect your RDP with a VPN;
• Do not rush through your inbox when reading new emails. While built-in scanners can flag some malicious messages and send them into the Spam box, some phishing emails can get into your Inbox. Therefore, do not carelessly open attachments or click on links;
• Patch your system and software as soon as the new updates are ready to be installed – it will protect hackers from abusing bugs in software to infect your system;
• Avoid high-risk websites and do not download any cracks, repacked software, and similar.

Get rid of Jemd ransomware and proceed with file recovery

If you cannot access your files and you read the Recovery.txt ransom message, do not panic. As we already mentioned, Jemd virus has plenty of flaws, and it will greatly help with dealing with it. To remove Jemd ransomware, you should download security software that can detect the infection – we suggest using FortectIntego. You then should enter Safe Mode with Networking, as explained below, and then perform a full system scan.

After Jemd ransomware removal, you can proceed with file recovery. We suggest first trying System Restore in case you do not have backups ready. Alternatively, you can use file recovery software that might help you.