J Ransomware

J Ransomware, also known as J-ransom and J-Ransomware, is a new ransomware-type infection detected by malware analysts at pcthreat.com recently. Although it is a new malicious application, it does not differ much from older threats analyzed by our researchers. Also, it is not one of those sophisticated ransomware infections which can cause huge damage to victims’ computers. Of course, it still locks users’ personal files located on Desktop (%USERPROFILE%\Desktop) and in the My Pictures folder (it is usually located in %PROGRAMFILES% or %PROGRAMFILES(x86)%). If you have been keeping your important documents, pictures, and other personal files there, you could have lost them forever. Unlike ransomware infections previously analyzed by our specialists, J Ransomware does not demand a ransom after the encryption, so our experienced researchers suspect that it is still a ransomware infection project that might evolve into something bigger in the future. Of course, there is also a possibility that it does not work properly at the time of writing. If you encounter its updated version asking money, do not pay cyber criminals a cent because there might be a way to restore files without the decryption key, e.g. restore them from a backup located on an external hard disk or a cloud drive.

J Ransomware is definitely not one of those extremely harmful malicious applications, but it is not a mild threat either because it encrypts users’ personal files once its malicious file is launched and it starts working on the system. You will first notice that you cannot open them. Then, you will see a new extension .LoveYou appended next to their original extensions. Like a bunch of other ransomware infections, it drops a ransom note ReadMe.txt after encrypting users’ files too; however, it contains only one sentence:

Hey you !! Congratulations. Your fucking files are all encoded

As can be seen, its ransom note does not contain any information about the decryption of files, so it might be impossible to purchase the decryption tool from cyber criminals and unlock files. Actually, we would not recommend transferring money in exchange for the decryptor even if it were possible to purchase it from malware developers because cyber criminals often take users’ money from them but do not give anything in return. In other words, there are no guarantees that users who pay money for the decryption tool will really get their files back. Actually, you might not even need it because there is a way to restore them without the special tool. Unfortunately, you can restore your files for free only if you have a backup.

It no longer surprises us that ransomware infections manage to enter users’ PCs without permission because they are mainly spread via spam emails and reach its targets when they open malicious attachments they find inside these emails. Since it is one of the most popular methods employed to disseminate ransomware infections, stay away from spam emails and periodically delete those sent to you by the people/companies you do not know to avoid the accidental opening of these malicious emails and the installation of malware.

J Ransomware is not one of those malicious applications which create new registry keys, block Task Manager or Registry Editor, or create new files on affected computer. It does not even have a point of execution, so you should be able to close it by rebooting your PC. Unfortunately, it does not mean that your files will be automatically decrypted or you will not need to delete ransomware components from your system.

You must delete J Ransomware from your computer as soon as possible and then install an automatic security application to protect your system from other harmful infections actively distributed these days. The J Ransomware removal should not be very complicated because there are only two files you need to remove: 1) the malicious file and 2) ReadMe.txt. Inexperienced users should, of course, let our manual removal guide help them or use an automatic malware remover instead of trying to delete this infection manually. Not all the tools promoted as powerful scanners can remove this ransomware infection, so do not download the first scanner you come across while surfing the web.

How to remove J Ransomware manually

1. Press Win+E to open the Windows Explorer.
2. Delete ReadMe.txt from %USERPROFILE%\Desktop (type the directory in the address bar and tap Enter to access it).
3. Go to these three directories and remove all suspicious files you find in them: %USERPROFILE%\Desktop, %USERPROFILE%\Downloads, and %TEMP%.
4. Empty the Recycle bin.