This article aims to explain how you can effectively remove JigSaw ransomware virus from your computer how to decrypt .lockedgood files for free.
JigSaw ransomware has been around for almost two years time now and when the first variant of this ransomware was launched, the virus aimed to scan for and encrypt over 120 file types on the infect machines of the users. The malware then displayed a lockscreen with the scary creature of JigSaw and shortly after this it also ads a countdown timer. The virus has gone through hundreds of variants since then and researchers have also developed a decryptor for it, so if you want to remove it from your computer and then decrypt your files for free, read this article thoroughly.
|Short Description||Encrypts the files on your computer and gives you a deadline timer to pay ransom in BitCoin to get them to work again.|
|Symptoms||Files are encrypted, containing the .lockedgood file extension.|
|Distribution Method||Spam Emails, Email Attachments, Executable files|
|Detection Tool|| See If Your System Has Been Affected by .lockedgood JigSaw |
Malware Removal Tool
|User Experience||Join Our Forum to Discuss .lockedgood JigSaw.|
|Data Recovery Tool||Windows Data Recovery by Stellar Phoenix Notice! This product scans your drive sectors to recover lost files and it may not recover 100% of the encrypted files, but only few of them, depending on the situation and whether or not you have reformatted your drive.|
.lockedgood JigSaw Ransomware – Distribution
The .lockedgood variant of JigSaw is believed to use a fake BitCoinGenerator.exe file which was reported at VirusTotal to have the following information:
→ SHA-256: 314a4304015be763d96cf7c12173a674debf451e654a96eb8aa872488b7c5754
Size: 1.91 MB
Such BitCoin generators are basically a common practice against scammers and they use them to upload fake .exe files on suspicious websites. Once the victim gets lured into downloading and executing it, infection is immediate.
.lockedgood JigSaw Variant – More Information
JigSaw ransomware has been detected in hundreds of types so far, all off which are decryptable. When this virus infects your computer, the following folders may be the places where it’s files might reside:
The virus then activates the virus file dropped, which immeidately gets down to encrypting your important files. The .lockedgood ransomware may encrypt files, based on their types. The malware targets the files, based on their file extensions. JigSaw usually scans for the following types of files:
→ .3dm, .3g2, .3gp, .7zip, .aaf, .accdb, .aep, .aepx, .aet, .ai, .aif, .as, .as.txt, .as3, .asf, .asp, .asx, .avi, .bmp, .c, .class, .cpp, .cs, .csv, .dat, .db, .dbf, .doc, .docb, .docm, .docx, .dot, .dotm, .dotx, .dwg, .dxf, .dxf.c, .efx, .eps, .fla, .flv, .gif, .h, .idml, .iff, .indb, .indd, .indl, .indt, .inx, .jar, .java, .jpeg, .jpg, .js, .m3u, .m3u8, .m4u, .max, .mdb, .mid, .mkv, .mov, .mp3, .mp4, .mpa, .mpeg, .mpg, .msg, .pdb, .pdf, .php, .plb, .pmd, .png, .pot, .potm, .potx, .ppam, .ppj, .pps, .ppsm, .ppsx, .ppt, .pptm, .pptx, .prel, .prproj, .ps, .psd, .py, .ra, .rar, .raw, .rb, .rtf, .sdf, .ses, .sldm, .sldx, .sql, .svg, .swf, .tif, .txt, .vcf, .vob, .wav, .wma, .wmv, .wpd, .wps, .xla, .xlam, .xll, .xlm, .xls, .xlsb, .xlsm, .xlsx, .xlt, .xltm, .xltx, .xlw, .xml, .xqx, .zip
After encryption, the ransomware drops a ransom note, and may leave behind a countdown timer. Luckily for victims, the virus is now decryptable and after removing it, keep reading this article for it’s recovery instructions, using the Jigsaw Decryper by demonslay335.
Jigsaw Ransomware Decryption Instructions
Before starting to download the decryptor and learning how to use it, we must have you know that this may take some time. This is why it is advisable to make your computer run permanently without automatically hibernating or shutting down automatically after some time. To do this, please follow the bellow-mentioned instructions:
1: Click on the battery icon in your system tray (next to the digital clock) in Windows and then click on More Power Options.
2: The Power Options menu will appear. In your power plan click on Change Plan Settings.
3: In your plan’s settings make sure you set “Turn off the display” and “Put computer to sleep” to “Never” from the drop down minutes menu.
4: Click on “Change Advanced Plan Settings” and click to expand the “Hard Disk” option in the list there.
5: From there, set the power settings (On Battery and Powered On) to “Never”.
After this has been complete, then you should start the decryption process itself. Even though nothing should go wrong, we strongly advise you to make sure that your files and computer are safe. To do this, you may either scan your computer with an advanced anti-malware program or create copies of the encrypted files and try to decrypt them from a safe PC, just in case something goes wrong.
Spy Hunter scanner will only detect the threat. If you want the threat to be automatically removed, you need to purchase the full version of the anti-malware tool.Find Out More About SpyHunter Anti-Malware Tool / How to Uninstall SpyHunter
After you have secured your computer, you should follow these instructions to download, install and use Jigsaw Decryptor by demonslay335:
Step 1: Download Jigsaw Decryptor from the button below and open the .ZIP file
Step 2: Extract the JigSawDecrypter.exe file whenever you feel comfortable to easily access it:
Step 3: Right-Click on it after which click on Run as Administrator… and you should see its primary interface:
Step 4: From there, click on the Select Directory button and choose a directory the files in which you want decrypted:
Step 5: Click on the button Ok after selecting and then click on Decrypt Files and wait for the decryption process to be complete:
Bear in mind that this process may take some time, it really depends on the files, their size and other factors, like the ransomware variant and its modification. This is why we strongly suggest you to take into consideration leaving your computer to work it out while you are not using it.
As a bottom line, we strongly advise users who have been infected by the JigSaw ransomware to follow these advises to prevent this mess from happening in the near future:
Advice 1: Make sure to read our general protection tips and try to make them your habit and educated others to do so as well.
Advice 2: Install an advanced anti-malware program that has an often updated real-time shield definitions and ransomware protection.
Advice 3: Seek out and download specific anti-ransomware software which is reliable.
Advice 4: Backup your files using one of the methods in this article.
Advice 5: : Make sure to use a secure web browser while surfing the world wide web.