Jokers House Ransomware

Jokers House Ransomware is a highly dangerous program as it might not only make all your personal data on the computer unusable but also threaten to erase it permanently. Therefore, if you are not planning on paying the ransom, it would probably be best to eliminate the infection immediately, because this way you will lose fewer files. The bad news is, even after deleting the malware the data will remain to be encrypted, so there will be of no use from it. In such case, all that would be left to do is wait and hope for the IT volunteer specialists to create a decryption tool. If you are considering paying the ransom instead, we have to warn you there are no guarantees the threat will actually decrypt your data as the malware’s creators promise. Accordingly, we advise removing Jokers House Ransomware for users who do not want to risk losing their money. The deletion instructions placed below may help users with the task, but if it looks too complicated, it might be best to use a trustworthy antimalware tool.

In the rest of the text we will tell you more about the malicious application’s working manner, but first of all, we would like to discuss its distribution methods and the ways users could avoid similar threats in the future. Our researchers discovered the malware might be spread with insecure software installers downloaded from doubtful file-sharing web pages. Once the user launches such setup file the infection may show a pop-up window saying “Software Activated, Thank you for your purchase.” If you remember what installer was launched before this message appeared, you should try to remember from where it might have been downloaded too, so you could stay away from this site in the future. Of course, one can never know where he might catch an infection; thus, it is best to download setup files only from legitimate web pages. Additionally, we would advise keeping a fully-updated antimalware tool that could guard the system against threats in case you accidentally encounter them.

After the malicious installer is launched Jokers House Ransomware should place a copy of it in the %APPDATA%\Windows Processing directory. Plus, it might create a Registry Entry in the following path HKCU\Software\Microsoft\Windows\CurrentVersion\Run. Then, it should not take long for it to start the encryption process. During it the malware may identify locations of its targeted files and begin locking them with the AES encryption algorithm. It would seem the malicious application can encrypt a wide range of file types, e.g., it could lock files with .jpg, .jpeg, .raw, .tif, .gif, .png, .bmp, .3dm, .max, .db, .dbf, .mdb, .pdb, .sql, .dwg, .c, .cpp, .cs, .h, .php, .asp, .rb, .java, .jar, .class, .py, .js, .aaf, .aep, .plb, .prel, .prproj, .aet, .ppj, .psd, .indd, .indl, .indt, and lots of other extensions. Files that get encrypted should receive an extension called .Contact_TarineOZA@Gmail.com_, flower.jpg.Contact_TarineOZA@Gmail.com_ and so on.

Lastly, the infection should open a pop-up window with a scary Joker face on it. Besides the picture the window slowly generates a ransom note written in green letters. The text explains what happened to your files and how to make a payment to decrypt them. As we mentioned at the beginning Jokers House Ransomware’s note may threaten to delete the encrypted data. To be more precise, it says all data will be removed after 24 hours and some of it will be erased each hour while waiting for the payment or even more of files could be deleted if the user closes the malware, shuts down the PC, and so on. The sample our researchers tested did not remove any files after closing the pop-up window. However, after launching the malicious application again, it erased approximately five hundred files as for punishment mentioned in the ransom note. This means you should not lose any data just for closing the pop-up as long as you do not restart the system or launch the threat yourself; just make sure you get rid of Jokers House Ransomware before turning off the PC.

Unfortunately, there is no way to decrypt data at the moment, although there is still hope IT specialists could create a free decryption tool. Paying the ransom might seem like the easiest solution, but it is also the riskiest one. There are no guarantees the files will be decrypted since there is always a chance the malware’s creators might trick you or the connection to the server could be lost; in which case, it would become impossible to reach the decryption key need for unlocking the data.

Those who decide not to risk their money should delete Jokers House Ransomware as soon as possible because the faster you do it, the less data you should lose. More experienced users could try using the deletion instructions placed below to eliminate the infection manually. Keep it in mind the process might be rather complicated, and if you do not think you can handle it, we recommend getting a reliable antimalware tool.

Get rid of Jokers House Ransomware

1. Press Ctrl+Shift+Delete.
2. Open the Task Manager.
3. Click Processes and find a process titled as cmd.exe.
4. Select it and press End task.
5. Close the Task Manager.
6. Press Win+R, type regedit and click OK.
7. Navigate to this location: HKCU\Software\Microsoft\Windows\CurrentVersion\Run
8. Find a value name called cmd.exe; its value data should point to %APPDATA%\Windows Processing\cmd.exe
9. Right-click this value name and press Delete.
10. Close the Registry Editor.
11. Press Win+E.
12. Go to %APPDATA%\Windows Processing
13. Find a file called cmd.exe, right-click it and select Delete.
14. Locate the malicious installer you had launched before computer got infected.
15. Right-click it and select Delete.
16. Close the Explorer.
17. Empty your Recycle bin.