JohnyCryptor Ransomware Removal Guide

JohnyCryptor Ransomware is a threat that might infect your computer because it is quite prevalent at the time of writing. Once it sneaks onto the computer, it performs the scan and finds all the files stored on it. After it finds all the files, it locks them and thus does not allow users to access them. Unfortunately, it seems that it will encrypt all kinds of files except those that are kept in the %WINDIR% directory. In other words, it only keeps system files untouched. As the majority of files will be inaccessible after JohnyCryptor Ransomware slithers onto the computer, you will immediately understand that something is wrong. Ransomware infections act like that because they seek to get money from innocent users; however, we do not recommend doing what ransomware says because there might be other ways to unlock files. Our specialists will tell you more about the removal of this ransomware infection as well in the article.

As you already know, JohnyCryptor Ransomware will immediately encrypt all the files, except system files stored on the computer. Unfortunately, it is targeted at valuable files, e.g. music, videos, pictures, and documents; however, it will also lock .exe files, which means that it will be impossible to open browsers and any other programs, including the antimalware scanner that could eliminate the ransomware infection from the system. It will not be hard to say which of the files are encrypted because they will have a new extension, for example, picture.jpg.-{ID}Johnycryptor@aol.com.xtbl. Of course, this ransomware infection will also create the .txt file on Desktop with the text “DECRYPT FILES EMAIL Johnycryptor@aol.com or Johnycryptor@india.com” and will set another picture as a Desktop background. The Wallpaper will contain the following text (an excerpt):

Attention!

Your computer has been encrypted by cryptographically strong algorithm. All your files are no encrypted. You have only one way to get them back safely – using original decryption tool. Using another tools could corrupt your files, use it on your own risk. To get original decryptor contact us with email.

JohnyCryptor@aol.com

We are sure that you will get an email with instructions how to make a payment for the decryption of files if you contact cyber criminals. If you are planning on paying money, you should write an email to JohnyCryptor@aol.com within one week because it is said that “we won’t keep your decryption keys at our servers more than one week.” Actually, we do not recommend paying money for cyber criminals because there might be a way to decrypt files free of charge. For example, you can use a free decryptor you can download from the Internet, or you can restore your files from a backup.

Unfortunately, JohnyCryptor Ransomware will not disappear after you restart your computer because it adds its main file, How to decrypt your files.txt, and the image for the background to %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup. Also, it means that it will encrypt your new files too, so we suggest that you remove this threat immediately and only then try to recover files free of charge. Continue reading to find out how to do that.

In order to make sure that other similar threats cannot sneak onto your PC, you should know how they travel. Security specialists working at 411-spyware.com have carried out research and found that this infection is usually spread via spam emails, for instance, it might pretend to be an invoice. Do not open spam emails and do not download their attachments because you might quickly cause harm to your computer. Security specialists also say that it would be smart to install security software for the sake of the system’s safety.

As JohnyCryptor Ransomware blocks .exe files and the majority of automatic tools, it seems that you will have to eliminate this infection in a manual way and only then scan the system with an automatic malware remover, e.g. SpyHunter. We hope that instructions we have put below this article will help you to take care of JohnyCryptor Ransomware. Keep in mind that they will help you to delete only JohnyCryptor Ransomware. In other words, you will have to take care of other threats that might hide on the system separately.

How to delete JohnyCryptor Ransomware

1. Open the Windows Explorer (Windows key + E).
2. Go to %WINDIR\SysWOW64.
3. Find and delete the file with the random name.
4. Go to %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup.
5. Delete three files: .exe file with the random name, How to decrypt your files.jpg, and How to decrypt your files.txt.
6. Empty the Recycle Bin.
7. Reboot your PC.