The ransom note suggests that all of victim’s files have been encrypted with strongest algorithms and cannot be recovered without the cybercriminals’ help. According to them, this “help” costs between $490-$980 in Bitcoin, depending how quickly the victim reaches out to the attackers via provided emails – support@sysmail.ch and helprestoremanager@airmail.cc. As stated in the note, the lower price point applies if the victim writes to the criminals within 72 hours. Otherwise, the ransom asked will rise to $980. As usual, the attackers want to receive the payment in cryptocurrency since this helps them to avoid being tracked down. Additionally, the note suggests testing the proposed JJTT ransomware decryption solution by sending one encrypted file to the attackers via email. The crooks suggest they would reply with a decrypted version of the file only to prove that it is “worth” paying the ransom. However, cybersecurity experts worldwide agree that paying the ransom is not recommended. The same is stated in official FBI’s guidelines regarding ransomware attacks. The reasons why you shouldn’t pay the ransom are simple. First of all, it never guarantees that you will recover your files. The decryption tool might be faulty or simply a deception; moreover, it might not work due to your modifications to files. Secondly, paying the ransom to cybercriminals encourages them to continue their activities, expand their team and this is simply wrongful approach after being hit by file-encrypting malware. Finally, you should be aware of the fact that STOP/DJVU ransomware variants like this one tend to compromise the system with information-stealing Trojans such as VIDAR or AZORULT. These malware pieces are capable of collecting login credentials, banking information, cookies, browsing history and more details that can lead to further blackmail. If you have been hit by this notorious malware, we strongly recommend that you remove JJTT ransomware virus without a delay. The best way to eradicate computer threats is by running an antivirus solution while the computer is booted in Safe Mode with Networking. You can find detailed instructions on how to secure your computer down below. In case you haven’t decided on which antivirus to use, consider trying one recommended by our team of experts – INTEGO Antivirus. Additionally, you may want to go ahead and download RESTORO, a tool that can identify and repair virus damage to Windows OS files.

Ransomware Summary

REPAIR VIRUS DAMAGE

How ransomware-type computer viruses are distributed

The most common distribution method associated with all STOP/DJVU ransomware variants including JJTT virus is malicious and deceptive online downloads. Cybercriminals were noticed to prey on victims who seek for pirated software versions online. The attackers upload fake software cracks, keygens and other tools that simply hide the ransomware payload in them for victims to download themselves. After opening the attached executable file, all victim’s files get compromised instantly. So far, victims have reported downloading the malware along software cracks of these popular programs:

Adobe Photoshop;KMSPico (illegal Windows activation tool);Tenorshare 4ukey;VMware Workstation;AutoCad;Opera browser;Corel Draw;Cubase;Adobe Illustrator;League of Legends;Internet Download Manager;Fifa 20;Various AV software.

Please do not download software from unconfirmed sources online (websites offering free and 100% working full software versions, torrent listings, etc.) as this can lead to severe computer infection and theft of your personal information. If you have a habit of doing it, you should remember that it infringes legitimate software copyrights and also puts your privacy at risk. Moreover, a legitimate software license fees are much lower than hefty ransom amounts demanded by cybercriminals. When in need of a specific software, please visit its official developer’s website or its confirmed partner’s website instead. Another popular way to distribute malware is by injecting a malicious code into documents (PDF, DOCX, XLS and other formats) and sending such files as email attachments to potential targets. The attackers go extreme lengths to deceive computer users, often posing as legitimate companies, work colleagues or bosses and suggesting to immediately open attached contents and reply to the sender. They might even make use of email spoofing techniques to obfuscate the real sender’s email address and display a different one. We recommend that you avoid opening emails you did not await for, and also look out for red flags in the email such as unfamiliar greeting line, sense of urgency, typo mistakes, low-quality and weirdly aligned logos. Finally, victims of STOP/DJVU ransomware should be cautious when it comes to looking for data recovery solutions online. At the moment of writing this, only Emsisoft and DiskTuna have confirmed solutions to decrypting/repairing files locked by this ransomware strain. However, the functionality of these tools is still limited and depends on several conditions. If you try to find other miracle decryption tools online, you might get infected with additional ransomware such as ZORAB. Its distributors have used the tactic of uploading fake STOP/DJVU decryptors online only to double-encrypt victim’s files.

How this ransomware operates on victim’s computer

In this article section, we will overlook the modus operandi of JJTT ransomware virus. It begins its attack by launching an executable named with 4 random characters, for instance, 5GB5.exe or 14H7.exe. This process then downloads two additional executables named build.exe and build2.exe. In some cases, a helper program under the name of winupdate.exe is also launched to display a fake Windows update prompt for the victim. The virus then begins collecting information about the breached computer. The way this ransomware works is that it targets computers in specific countries only rather than infecting computers worldwide. It appears that the ransomware is designed not to encrypt files on a computer if it is located in one of the following Commonwealth of Independent Sates (CIS): Armenia, Azerbaijan, Belarus, Kazakhstan, Kyrgyzstan, Moldova, Russia, Turkmenistan, Tajikistan, Uzbekistan and Ukraine. To find out computer’s location, the virus connects to https[:]//api.2ip.ua/geo.json and saves the response from this URL to geo.json file. You can see two typical examples of such file below; it contains details such as country code, name, region, timezone, zip code, city, longitude, latitude and so on. Next, the ransomware creates another text file called information.txt. This file comprises computer’s hardware information, installed software list and active processes. The virus then also takes a screenshot of computer’s desktop and then sends these two files to the cybercriminals’ Command&Control server. You can see a screenshot of this file below. Next, the ransomware tries to obtain a uniquely generated victim’s encryption key along with personal ID from its Command&Control server. If it succeeds to do so, the victim’s files will be modified with so-called online encryption. If the virus fails to establish the connection with its server, it falls back to so-called offline encryption mode. The difference between these two is that for all victims of offline encryption, the same decryption key can be used to recover all files; in other words, there are slight chances to decrypt .jjtt files in the future as explained in this guide. For online encryption, each victim needs a unique decryption key that matches with the unique encryption key used. The virus saves the encryption key and victim’s ID into the bowsakkdestx.txt file and also saves the ID into PersonalID.txt file. You can check whether you were affected by online or offline key by inspecting C:\SystemID\PersonalID.txt file. If the string saved there ends in t1, it indicates offline key encryption. You can see an example of both files down below. The ransomware then begins encrypting all data stored on the computer. It uses Salsa20 algorithm for initial encryption and then secures it with private RSA-2048 key. During this process, each file gets appended with .jjtt file extension. You can see how a virus-affected data folder looks like in the screenshot attached below. The virus also drops a ransom note named as _readme.txt in several computer folders. Contents of it are showcased below. Next, the ransomware takes care of Volume Shadow Copies. The virus removes them from the computer using the following Command Prompt task: ssadmin.exe Delete Shadows /All /Quiet Finally, the threat modifies Windows HOSTS file. It uploads a list of websites publishing information about computer security, ransomware incident response and related data. The domains of these websites are mapped to victim’s localhost IP, thus causing DNS resolution problem. The computer user can no longer access these websites. Errors equivalent to DNS_PROBE_FINISHED_NXDOMAIN error may appear in web browser when trying to access one of the blocked sites.

Remove JJTT Ransomware Virus and Decrypt Your Files

Victims who had their files encrypted by this notorious malware should rush to remove JJTT ransomware virus and related threats from their computers as soon as possible. This is needed to eliminate virus’ remains and information-stealing Trojans installed. For this, we recommend using the guide provided below to boot your PC in Safe Mode with Networking. From there, run your antivirus software. If you aren’t sure which AV solution to use, consider using a robust and well-reviewed software recommended by our team – INTEGO Antivirus. As an extra step, we recommend you to download RESTORO, a tool that has been proved effective when it comes to repairing virus-damaged Windows OS files. If you have completed JJTT ransomware removal, please consider reading the following recommendations:

Inform your local law enforcement agency about the ransomware attack you just experienced.Use data backups to restore your files fully or partially.Learn possible ways variants of STOP/DJVU encrypted files could be decrypted.Change all passwords that were used on the compromised computer.

OUR GEEKS RECOMMEND Our team recommends a two-step rescue plan to remove ransomware and other remaining malware from your computer, plus repair caused virus damage to the system: GeeksAdvice.com editors select recommended products based on their effectiveness. We may earn a commission from affiliate links, at no additional cost to you. Learn more. Get INTEGO ANTIVIRUS for Windows to remove ransomware, Trojans, adware and other spyware and malware variants and protect your PC and network drives 24/7. This VB100-certified security software uses state-of-art technology to provide protection against ransomware, Zero-Day attacks and advanced threats, Intego Web Shield blocks dangerous websites, phishing attacks, malicious downloads and installation of potentially unwanted programs. Use INTEGO Antivirus to remove detected threats from your computer. Read full review here. RESTORO provides a free scan that helps to identify hardware, security and stability issues and presents a comprehensive report which can help you to locate and fix detected issues manually. It is a great PC repair software to use after you remove malware with professional antivirus. The full version of software will fix detected issues and repair virus damage caused to your Windows OS files automatically. RESTORO uses AVIRA scanning engine to detect existing spyware and malware. If any are found, the software will eliminate them. Read full review here.

Method 1. Enter Safe Mode with Networking

Before you try to remove JJTT Ransomware Virus virus, you must start your computer in Safe Mode with Networking. Below, we provide the easiest ways to boot PC in the said mode, but you can find additional ones in this in-depth tutorial on our website – How to Start Windows in Safe Mode. Also, if you prefer a video version of the tutorial, check our guide How to Start Windows in Safe Mode on Youtube. Instructions for Windows XP/Vista/7 users Instructions for Windows 8/8.1/10/11 users Now, you can search for and remove JJTT Ransomware Virus files. It is very hard to identify files and registry keys that belong to the ransomware virus, Besides, malware creators tend to rename and change them repeatedly. Therefore, the easiest way to uninstall such type of a computer virus is to use a reliable security program such as INTEGO Antivirus. For virus damage repair, consider using RESTORO.

Method 2. Use System Restore

In order to use System Restore, you must have a system restore point, created either manually or automatically. Instructions for Windows XP/Vista/7 users Instructions for Windows 8/8.1/10/11 users After restoring the system, we recommend scanning the system with antivirus or anti-malware software. In most cases, there won’t be any malware remains, but it never hurts to double-check. In addition, we highly recommend checking ransomware prevention guidelines provided by our experts in order to protect your PC against similar viruses in the future.

Alternative software recommendations

Malwarebytes Anti-Malware Removing spyware and malware is one step towards cybersecurity. To protect yourself against ever-evolving threats, we strongly recommend purchasing a Premium version of Malwarebytes Anti-Malware, which provides security based on artificial intelligence and machine learning. Includes ransomware protection. See pricing options and protect yourself now.

System Mechanic Ultimate Defense If you’re looking for an all-in-one system maintenance suite that has 7 core components providing powerful real-time protection, on-demand malware removal, system optimization, data recovery, password manager, online privacy protection and secure driver wiping technology. Therefore, due to its wide-range of capabilities, System Mechanic Ultimate Defense deserves Geek’s Advice approval. Get it now for 50% off. You may also be interested in its full review.

Disclaimer. This site includes affiliate links. We may earn a small commission by recommending certain products, at no additional cost for you. We only choose quality software and services to recommend.

Decrypt JJTT files

Fix and open large JJTT files easily:

It is reported that STOP/DJVU ransomware versions encrypt only the beginning 150 KB of each file to ensure that the virus manages to affect all files on the system. In some cases, the malicious program might skip some files at all. That said, we recommend testing this method on several big (>1GB) files first.

STOP/DJVU decryption tool usage guide

STOP/DJVU ransomware versions are grouped into old and new variants. JJTT Ransomware Virus is considered the new STOP/DJVU variant, just like BPTO, ISWR, ISZA, BPSM, ZOUU, MBTF, ZNSM (find full list here). This means full data decryption is now possible only if you have been affected by offline encryption key. To decrypt your files, you will have to download Emsisoft Decryptor for STOP DJVU, a tool created and maintained by a genius security researcher Michael Gillespie. Note! Please do not spam the security researcher with questions whether he can recover your files encrypted with online key - it is not possible. In order to test the tool and see if it can decrypt JJTT files, follow the given tutorial.

Meanings of decryptor’s messages

The JJTT decryption tool might display several different messages after failed attempt to restore your files. You might receive one of the following messages: Error: Unable to decrypt file with ID: [example ID] This message typically means that there is no corresponding decryption key in the decryptor’s database. No key for New Variant online ID: [example ID]Notice: this ID appears to be an online ID, decryption is impossible This message informs that your files were encrypted with online key, meaning no one else has the same encryption/decryption key pair, therefore data recovery without paying the criminals is impossible. Result: No key for new variant offline ID: [example ID]This ID appears to be an offline ID. Decryption may be possible in the future. If you were informed that an offline key was used, but files could not be restored, it means that the offline decryption key isn’t available yet. However, receiving this message is extremely good news, meaning that it might be possible to restore your JJTT extension files in the future. It can take a few months until the decryption key gets found and uploaded to the decryptor. We recommend you to follow updates regarding the decryptable DJVU versions here. We strongly recommend backing up your encrypted data and waiting.

Victims of JJTT Ransomware Virus should report the Internet crime incident to the official government fraud and scam website according to their country:

In the United States, go to the On Guard Online website.In Australia, go to the SCAMwatch website.In Germany, go to the Bundesamt für Sicherheit in der Informationstechnik website.In Ireland, go to the An Garda Síochána website.In New Zealand, go to the Consumer Affairs Scams website.In the United Kingdom, go to the Action Fraud website.In Canada, go to the Canadian Anti-Fraud Centre.In India, go to Indian National Cybercrime Reporting Portal.In France, go to the Agence nationale de la sécurité des systèmes d’information.

If you can’t find an authority corresponding to your location on this list, we recommend using any search engine to look up “[your country name] report cyber crime”. This should lead you to the right authority website. We also recommend staying away from third-party crime report services that are often paid. It costs nothing to report Internet crime to official authorities. Another recommendation is to contact your country’s or region’s federal police or communications authority.