This article aims to help you by explaining what is JigSaw ransomware’s Turkish variant, using the .justice file extension, how to remove it and how to decrypt .justice encrypted files for free, using Jigsaw Decrypter.
When we first detected JigSaw ransomware it was nothing but a lockscreen, displaying a contdown timer. With time, however, the virus spread in hundreds of variants and begun to encrypt over 100 types of files on the computers that have been infected by it. What is not changed with the latest variant, using the .justice file extension which is added at the end of each file’s name. In addition to this, the ransomware has also been released in the deep web for sale as a RaaS (ransomware as a service scheme). This resulted in it exploding into multiple variants, which pushed malware researchers into finding a free way to decrypt files encrypted by it. If you computer has been infected by this JigSaw ransomware variant, we recommend that you focus on removing it from your computer and decrypting your files for free, preferably by using the information in this article.
|Short Description||Part of the JigSaw ransomware family. Encrypts the files on victims’ computers and then asks for ransom to be paid.|
|Symptoms||Files are encrypted with an added .justice file extension and become no longer openable.|
|Distribution Method||Via e-mail attachments, fake setups or other executables or malicious Macros.|
|Detection Tool|| See If Your System Has Been Affected by .justice Ransomware |
Malware Removal Tool
|User Experience||Join Our Forum to Discuss .justice Ransomware.|
Jigsaw .justice Ransomware – More Information and Background
When the virus was first released out in the wild, it displayed an image from the horror movie Jigsaw, and along with it a timer which deletes 1 file based on the Russian roulette principle:
In addition to this, to gain access to the files, the malware requests the sum of around 150 dollars. Since this variant, many other variants of JigSaw have also showed up in the wild and here are few examples of those:
This became typical for JigSaw ransowmare variants and they have all begun to increase the ransom payoff as time went by. One variant of the virus even requested from victims to pay the insane ammount of 5000$ which is outright insane. However, later on, malware researchers, like Michael Gillespie and other have developed a decrypter for this infection and if your PC has been compromised by this JigSaw ransomware variant, we recommend that you follow the instructions underneath to decrypt your files without paying the ransom:
This variant of JigSaw differs in most variants in the fact that it uses a rather interesting file extension which it adds to the files after it encrypts them, making them appear like the following:
Jigsaw Ransomware Decryption Instructions
Before starting to download the decrypter for JigSaw .justice ransomware and learning how to use it, we must have you know that this may take some time. This is why it is advisable to make your computer run permanently without automatically hibernating or shutting down automatically after some time. To do this, please follow the bellow-mentioned instructions:
1: Click on the battery icon in your system tray (next to the digital clock) in Windows and then click on More Power Options.
2: The Power Options menu will appear. In your power plan click on Change Plan Settings.
3: In your plan’s settings make sure you set “Turn off the display” and “Put computer to sleep” to “Never” from the drop down minutes menu.
4: Click on “Change Advanced Plan Settings” and click to expand the “Hard Disk” option in the list there.
5: From there, set the power settings (On Battery and Powered On) to “Never”.
After this has been complete, then you should start the decryption process itself. Even though nothing should go wrong, we strongly advise you to make sure that your files and computer are safe. To do this, you may either scan your computer with an advanced anti-malware program or create copies of the encrypted files and try to decrypt them from a safe PC, just in case something goes wrong.
Spy Hunter scanner will only detect the threat. If you want the threat to be automatically removed, you need to purchase the full version of the anti-malware tool.Find Out More About SpyHunter Anti-Malware Tool / How to Uninstall SpyHunter
After you have secured your computer, you should follow these instructions to download, install and use Jigsaw Decryptor by demonslay335:
Step 1: Download Jigsaw Decryptor from the button below and open the .ZIP file
Step 2: Extract the JigSawDecrypter.exe file whenever you feel comfortable to easily access it:
Step 3: Right-Click on it after which click on Run as Administrator… and you should see its primary interface:
Step 4: From there, click on the Select Directory button and choose a directory the files in which you want decrypted:
Step 5: Click on the button Ok after selecting and then click on Decrypt Files and wait for the decryption process to be complete:
Bear in mind that this process may take some time, it really depends on the files, their size and other factors, like the ransomware variant and its modification. This is why we strongly suggest you to take into consideration leaving your computer to work it out while you are not using it.
As a bottom line, we strongly advise users who have been infected by the JigSaw .justice ransomware to follow these advises to prevent this mess from happening in the near future:
Advice 1: Make sure to read our general protection tips and try to make them your habit and educated others to do so as well.
Advice 2: Install an advanced anti-malware program that has an often updated real-time shield definitions and ransomware protection.
Advice 3: Seek out and download specific anti-ransomware software which is reliable.
Advice 4: Backup your files using one of the methods in this article.
Advice 5: : Make sure to use a secure web browser while surfing the world wide web.
- Guide 1: How to Remove .justice Ransomware from Windows.
- Guide 2: Get rid of .justice Ransomware from Mac OS X.
How to Remove .justice Ransomware from Windows.
Step 1: Boot Your PC In Safe Mode to isolate and remove .justice Ransomware
Step 2: Uninstall .justice Ransomware and related software from Windows
Here is a method in few easy steps that should be able to uninstall most programs. No matter if you are using Windows 10, 8, 7, Vista or XP, those steps will get the job done. Dragging the program or its folder to the recycle bin can be a very bad decision. If you do that, bits and pieces of the program are left behind, and that can lead to unstable work of your PC, errors with the file type associations and other unpleasant activities. The proper way to get a program off your computer is to Uninstall it.
Step 3: Clean any registries, created by .justice Ransomware on your computer.
The usually targeted registries of Windows machines are the following:
You can access them by opening the Windows registry editor and deleting any values, created by .justice Ransomware there. This can happen by following the steps underneath:
Step 4: Scan for .justice Ransomware with SpyHunter Anti-Malware Tool
Step 5 (Optional): Try to Restore Files Encrypted by .justice Ransomware.
Ransomware infections and .justice Ransomware aim to encrypt your files using an encryption algorithm which may be very difficult to decrypt. This is why we have suggested a data recovery method that may help you go around direct decryption and try to restore your files. Bear in mind that this method may not be 100% effective but may also help you a little or a lot in different situations.
If the above link does not work for you and your region, try the other two links below, that lead to the same product:
Get rid of .justice Ransomware from Mac OS X.
Step 1: Uninstall .justice Ransomware and remove related files and objects
1. Hit the ⇧+⌘+U keys to open Utilities. Another way is to click on “Go” and then click “Utilities”, like the image below shows:
- Go to Finder.
- In the search bar type the name of the app that you want to remove.
- Above the search bar change the two drop down menus to “System Files” and “Are Included” so that you can see all of the files associated with the application you want to remove. Bear in mind that some of the files may not be related to the app so be very careful which files you delete.
- If all of the files are related, hold the ⌘+A buttons to select them and then drive them to “Trash”.
In case you cannot remove .justice Ransomware via Step 1 above:
In case you cannot find the virus files and objects in your Applications or other places we have shown above, you can manually look for them in the Libraries of your Mac. But before doing this, please read the disclaimer below:
You can repeat the same procedure with the following other Library directories:
Tip: ~ is there on purpose, because it leads to more LaunchAgents.
Step 2: Scan for and remove .justice Ransomware files from your Mac
When you are facing problems on your Mac as a result of unwanted scripts and programs such as .justice Ransomware, the recommended way of eliminating the threat is by using an anti-malware program. Combo Cleaner offers advanced security features along with other modules that will improve your Mac’s security and protect it in the future.
Step 3 (Optional): Try to Restore Files Encrypted by .justice Ransomware on your Mac.
Ransomware for Mac .justice Ransomware aims to encode all your files using an encryption algorithm which may be very difficult to decode, unless you pay money. This is why we have suggested a data recovery method that may help you go around direct decryption and try to restore your files, but only in some cases. Bear in mind that this method may not be 100% effective but may also help you a little or a lot in different situations.