Remove Jett Ransomware

Jett ransomware is a dangerous file-encrypting malware designed to lock users’ data and demand a ransom for decryption. This ransomware was discovered through malware samples submitted to VirusTotal, and it appends the “.jett” extension to encrypted files while also adding the victim’s ID and the email address “info@cloudminerapp.com.” Jett ransomware creates two ransom notes: “info.hta” and “ReadMe.txt,” which instruct victims on how to recover their files.

Summary of Jett Ransomware

Jett Ransomware Overview

Jett ransomware uses strong AES-256 and RSA-2048 encryption algorithms, making it nearly impossible to decrypt files without the attacker’s decryption tool. The ransom note provides contact details, including email addresses and a Telegram ID, urging victims to communicate for further instructions and payment details.

Example of File Modification:

• Original file: 1.jpg
• Encrypted file: 1.jpg.[9ECFA84E][info@cloudminerapp.com].jett
• Original file: 2.png
• Encrypted file: 2.png.[9ECFA84E][info@cloudminerapp.com].jett

Jett Ransomware Ransom Note

Text in info.hta

ALL YOUR VALUABLE DATA WAS ENCRYPTED!
due to a security problem with your PC. If you want to restore them, write us to the e-mail info@cloudminerapp.com
Write this ID in the title of your message:-
In case of no answer in 24 hours write us to this e-mail:3998181090@qq.com
You have to pay for decryption in Bitcoins. The price depends on how fast you write to us. After payment we will send you the tool that will decrypt all your files.

Free decryption as guarantee
Before paying you can send us up to 5 files for free decryption. The total size of files must be less than 4Mb (non-archived), and files should not contain valuable information. (databases, backups, large excel sheets, etc.)

How to obtain Bitcoins
The easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 'Buy bitcoins,' and select the seller by payment method and price.
hxxps://localbitcoins.com/buy_bitcoins

Also, you can find other places to buy Bitcoins and beginners' guide here:
hxxp://www.coindesk.com/information/how-can-i-buy-bitcoins/

Attention!
Do not rename encrypted files.
Do not try to decrypt your data using third-party software, it may cause permanent data loss.
Decryption of your files with the help of third parties may cause an increased price (they add their fee to ours), or you can become a victim of a scam.

Text in ReadMe.txt

ALL YOUR VALUABLE DATA WAS ENCRYPTED!
All your files were encrypted with strong crypto algorithm AES-256 + RSA-2048.
Please be sure that your files are not broken and you can restore them today.

If you really want to restore your files please write us to the e-mails:

For faster support Write Us To The ID-Telegram: @decrypt30 (hxxps://t.me/decrypt30)
info@cloudminerapp.com
3998181090@qq.com

In the subject line, write your ID: -

Important! Please send your message to all of our three e-mail addresses. This is really important because of delivery problems of some mail services!

Important! If you haven't received a response from us within 24 hours, please try to use a different email service (Gmail, Yahoo, AOL, etc).

Important! Please check your SPAM folder each time you wait for our response! If you find our email in the SPAM folder please move it to your Inbox.

Important! We are always in touch and ready to help you as soon as possible!

Attach up to 2 small encrypted files for free test decryption. Please note that the files you send us should not contain any valuable information. We will send you test decrypted files in our response for your confidence.

Of course, you will receive all the necessary instructions on how to decrypt your files!

Important!
Please note that we are professionals and just doing our job!
Please do not waste the time and do not try to deceive us - it will result only in a price increase!
We are always open for dialogue and ready to help you.

Manual Ransomware Removal Guide

Warning: Manual removal is complex and risky. If not done correctly, it can lead to data loss or incomplete removal of ransomware. Only follow this method if you are an advanced user. If unsure, proceed with Method 2 (SpyHunter Removal Guide).

Step 1: Disconnect from the Internet

1. Unplug your Ethernet cable or disconnect Wi-Fi immediately to prevent further communication with the ransomware’s command and control (C2) servers.

Step 2: Boot into Safe Mode

For Windows Users:

1. For Windows 10, 11:
   • Press Windows + R, type msconfig, and hit Enter.
   • Go to the Boot tab.
   • Check Safe boot and select Network.
   • Click Apply and OK, then restart your PC.
2. For Windows 7, 8:
   • Restart your PC and press F8 repeatedly before Windows loads.
   • Select Safe Mode with Networking and press Enter.

For Mac Users:

1. Restart your Mac and immediately press and hold the Shift key.
2. Release the key once you see the Apple logo.
3. Your Mac will start in Safe Mode.

Step 3: Locate and Terminate Malicious Processes

For Windows Users:

1. Press Ctrl + Shift + Esc to open Task Manager.
2. Look for suspicious processes (e.g., unknown names, high CPU usage, or random letters).
3. Right-click on the process and select End Task.

For Mac Users:

1. Open Activity Monitor (Finder > Applications > Utilities > Activity Monitor).
2. Look for unusual processes.
3. Select the process and click Force Quit.

Step 4: Delete Malicious Files

For Windows Users:

1. Press Windows + R, type %temp%, and hit Enter.
2. Delete all files in the Temp folder.
3. Navigate to:
   • C:\Users\[Your Username]\AppData\Roaming
   • C:\Users\[Your Username]\AppData\Local
   • C:\Windows\System32
4. Look for suspicious files related to the ransomware (random file names, recently modified) and delete them.

For Mac Users:

1. Open Finder and go to Go > Go to Folder.
2. Type ~/Library/Application Support and delete suspicious folders.
3. Navigate to ~/Library/LaunchAgents and remove unknown .plist files.

Step 5: Remove Ransomware from Registry or System Settings

For Windows Users:

Warning: Incorrect changes in the Registry Editor can damage your system. Proceed with caution.

1. Press Windows + R, type regedit, and hit Enter.
2. Navigate to:
   • HKEY_CURRENT_USER\Software
   • HKEY_LOCAL_MACHINE\Software
3. Look for unfamiliar folders with random characters or ransomware-related names.
4. Right-click and select Delete.

For Mac Users:

1. Go to System Preferences > Users & Groups.
2. Click on Login Items and remove any suspicious startup items.
3. Navigate to ~/Library/Preferences and remove malicious .plist files.

Step 6: Restore System Using System Restore (Windows) or Time Machine (Mac)

For Windows Users:

1. Press Windows + R, type rstrui, and hit Enter.
2. Click Next, choose a restore point before the infection, and follow the prompts to restore your system.

For Mac Users:

1. Restart your Mac and hold Command + R to enter macOS Utilities.
2. Select Restore from Time Machine Backup.
3. Choose a backup prior to the ransomware infection and restore your system.

Step 7: Use a Decryption Tool (If Available)

• Visit No More Ransom (www.nomoreransom.org) and check if a decryption tool is available for your ransomware variant.

Step 8: Recover Files Using Backup

• If you have backups on an external drive or cloud storage, restore your files.

Automatic Ransomware Removal Using SpyHunter

If manual removal seems too risky or complicated, using a reliable anti-malware tool like SpyHunter is the best alternative.

Step 1: Download SpyHunter

Download SpyHunter from the official link: Download SpyHunter

Or follow the official installation instructions here:
SpyHunter Download Instructions

Step 2: Install SpyHunter

1. Open the downloaded file (SpyHunter-Installer.exe).
2. Follow the on-screen prompts to install the program.
3. Once installed, launch SpyHunter.

Step 3: Perform a Full System Scan

1. Click on Start Scan Now.
2. SpyHunter will scan for ransomware and other malware.
3. Wait for the scan to complete.

Step 4: Remove Detected Threats

1. After the scan, SpyHunter will list all detected threats.
2. Click Fix Threats to remove the ransomware.

Step 5: Use SpyHunter’s Malware HelpDesk (If Needed)

If you are dealing with a stubborn ransomware variant, SpyHunter’s Malware HelpDesk provides custom fixes to remove advanced threats.

Step 6: Restore Your Files

If your files are encrypted:

• Try No More Ransom (www.nomoreransom.org) for decryption tools.
• Restore from cloud storage or external backups.

Preventing Future Ransomware Attacks

• Keep backups on an external hard drive or cloud storage.
• Use SpyHunter to detect threats before they infect your system.
• Enable Windows Defender or a trusted antivirus program.
• Avoid suspicious emails, attachments, and links.
• Update Windows, macOS & software regularly.

Conclusion

Jett ransomware is a severe cybersecurity threat that encrypts files and demands payment in Bitcoin for decryption. Victims are urged not to pay the ransom, as it does not guarantee file recovery. Cybercriminals use various deceptive techniques to spread this malware, making it essential to adopt strong security practices to prevent infection.