Jest Ransomware

Jest Ransomware is a malicious computer infection that will encrypt your files, and then you will have to look for ways to retrieve them. Getting infected with ransomware is a terrible experience and we don’t wish that on anyone. However, if this program managed to enter your system, you should follow the manual removal instructions below this description to get rid of Jest Ransomware for good. Please remember than removing ransomware from your system is not enough to protect it from serious threats. You should also consider investing in a powerful antispyware tool and learning more about cyber security.

You might ask how learning about cybersecurity could protect your system from ransomware. Well, if you know how the likes of Jest Ransomware spread around, you should be able to avoid them, and then you would save a lot of time you would otherwise spend looking for ways to restore your files.

It doesn’t look like Jest Ransomware belongs to any of the prominent ransomware families, but it doesn’t mean that it makes it any less dangerous. According to the research collected by our team, Jest Ransomware most probably spreads through spam emails, unsecured RDP connections, and malicious downloads. This shows that users download and install the ransomware on their computers willingly. Of course, no one is aware of the fact that they install Jest Ransomware on their systems. That’s because the installer file for this infection usually looks like a legitimate document.

It is up to you whether you launch the document or not. If you deal with multiple documents every single day, and you need to open file attachments on a regular basis, you might not think much about the file that delivers Jest Ransomware to your computer. However, computer security experts say it would be a good idea to scan all the received files with a security tool before opening them. If you have malicious files downloaded, a security scan would tell you about that immediately. Consequently, you would prevent Jest Ransomware from entering your system. On the other hand, if Jest Ransomware manages to enter the target system, then the users are bound for the usual ransomware infection experience.

First, the infection will scan your computer looking for all the files it can encrypt. You will not be notified about this scan. Once the scan is complete, Jest Ransomware will launch the file encryption. When the encryption is complete, you will finally notice that something is off because the infection will change your desktop background. Some users might think that restarting the system would make the ransomware notification go away, but that doesn’t work because Jest Ransomware auto-starts with Windows. So, you will always see the following message on your screen:

!! ATTENTION !!

YOUR FILES HAVE BEEN ENCRYPTED!

All of your documents, photos, databases and other important files have been encrypted with RSA encryption.
You will not be able to recover your files without the private key which has been saved on our server.
An antivirus cannot recovery your files.
View the “Decryption Notes” on your Desktop to fix this.

The so-called “Decryption Notes” is a ransom note that comes with instructions on how to purchase the decryption key. Needless to say, you should never follow the instructions because you would only help these criminals make more money. Instead, you have to remove Jest Ransomware from your system as soon as possible, and then look for ways to restore your files.

If you happen to have a file backup, then you just need to delete the encrypted files along with the malware, and copy and paste the healthy copies back into your clean system. That would be it.

If you do not have a file backup, you might want to go through your flash drives, your inboxes, outboxes, mobile devices, cloud drives, and other places where you might have stored your latest files. The chances are that you might still recover some of them. It would also be a good idea to address a professional technician for more file recovery options.

Finally, do not forget to invest in a licensed security tool. It would help you delete any remaining malicious files from your computer, at the same time protecting you from similar threats in the future.

How to Remove Jest Ransomware

1. Remove the EXE file that launched the infection.
2. Press Win+R and type regedit. Click OK.
3. Go to HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run.
4. On the right side, right-click and delete the VYCWMR value that points to ProgramData.
5. Exit Registry Editor and press Win+R again.
6. Type %ALLUSERSPROFILE% into the Open box and click OK.
7. Remove the following files from the directory:
   1.bmp
   ransomware.exe
   chk.dat
   encryptedfiles.eco
   MSWINSCK.OCX
   note.ini
   recover.exe
   rps.exe
8. Delete the Decryption Note.lnk file from Desktop.
9. Run a full system scan with the SpyHunter free scanner.