How to Remove Java File Virus

How to Remove Java File Ransomware?

Readers recently started to report the following message being displayed when they boot their computer:

All your files have been encrypted!
All your files have been encrypted due to a security problem with your PC. If you want to restore them, write us to the e-mail sabantui@tutanota.com
Write this ID in the title of your message B8F053EC
In case of no answer in 24 hours write us to theese e-mails:udacha@cock.li
You have to pay for decryption in Bitcoins. The price depends on how fast you write to us. After payment we will send you the decryption tool that will decrypt all your files.

Bad news, everyone! Malware researchers detected a new potential threat – the Java File Virus. This malicious virus is the new version of the Dharma ransomware. It encrypts the victim’s personal data and extorts them into paying a ransom by leaving a note on the desktop. This ransomware uses the .java extension and adds a unique identification number in the file name (i.e. id-312465798.java). If you see a sudden change in your file names – you are in trouble. As a typical ransomware attack goes, in order for the user to decrypt the infected files, they must pay the fee indicated in the ransom note.

How did I get infected with?

Chances are, you spread the virus unknowingly. In most cases, this pest is waiting patiently for you to help it infect your data. How? By opening emails of unknown origin. More often than not, they contain some form of malicious software. Which is why it is very important that you think twice before opening emails from unknown senders. The same thing goes for email attachments and executable files. Often they come in the form of spam emails with curious titles that would easily catch your attention and put you on high alert. So it’s best to be cautious at all times.

Why is Java File dangerous?

No one wants to lose their personal data, right? In our everyday life, we depend so much on our electronic devices like our phone or computer. And the thing is, more and more people prefer to shop online. It is generally a good thing because it can save you time, but it also poses a great threat to your bank account information. Cyber criminals could easily gain access to that important data and can use it for their own benefit. Not to mention the possibility of sharing that data with other people. A scarier scenario would be that this ransomware attack happened while you were at work. Which would mean that your company private data has been compromised and potentially that of your customers. If you want none of this to happen to you, make sure that your PC is protected by professional software that can deal with all types of malicious software. Even if you are being careful while browsing the internet, it is always best to be safe than sorry!

Java File Removal Instructions

STEP 1: Kill the Malicious Process

STEP 2: Reveal Hidden Files

STEP 3: Locate Startup Location

STEP 4: Recover Java File Encrypted Files

STEP 1: Stop the malicious process using Windows Task Manager

• Open your task Manager by pressing CTRL+SHIFT+ESC keys simultaneously
• Locate the process of the ransomware. Have in mind that this is usually a random generated file.
• Before you kill the process, type the name on a text document for later reference.

• Locate any suspicious processes associated with Java File encryption Virus.
• Right click on the process
• Open File Location
• End Process
• Delete the directories with the suspicious files.
• Have in mind that the process can be hiding and very difficult to detect

STEP 2: Reveal Hidden Files

• Open any folder
• Click on “Organize” button
  
• Choose “Folder and Search Options”
• Select the “View” tab
• Select “Show hidden files and folders” option
• Uncheck “Hide protected operating system files”
• Click “Apply” and “OK” button

STEP 3: Locate Java File encryption Virus startup location

• Once the operating system loads press simultaneously the Windows Logo Button and the R key.

• A dialog box should open. Type “Regedit”
• WARNING! be very careful when editing the Microsoft Windows Registry as this may render the system broken.

Depending on your OS (x86 or x64) navigate to:

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run] or
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] or
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]

• and delete the display Name: [RANDOM]

• Then open your explorer and navigate to:

Navigate to your %appdata% folder and delete the executable.

You can alternatively use your msconfig windows program to double check the execution point of the virus. Please, have in mind that the names in your machine might be different as they might be generated randomly, that’s why you should run any professional scanner to identify malicious files.

STEP 4: How to recover encrypted files?

• Method 1: The first and best method is to restore your data from a recent backup, in case that you have one.

• Method 2: File Recovery Software – Usually when the ransomware encrypts a file it first makes a copy of it, encrypts the copy, and then deletes the original. Due to this you may try to use file recovery software to recover some of your original files.
• Method 3: Shadow Volume Copies – As a last resort, you can try to restore your files via Shadow Volume Copies. Open the Shadow Explorer part of the package and choose the Drive you want to recover. Right click on any file you want to restore and click Export on it.