How to Remove JokeFromMars File Lock Ransomware

Basic Information of JokeFromMars Ransomware

If you’re search for the information of JokeFromMars, you should know that it is a notorious and aggressive ransomware virus. Its creators have been using ransomware viruses like JokeFromMars to make a lot of money from gullible people around the world. Once this ransomware virus attacks your computer, it will drop a harmful executable file that will scan your computer and search for files that end with certain extensions, such as .mp4, .jpeg, .txt, .docx, .pdf and so on. JokeFromMars ransomware deliberately takes full control of your personal files and holds them hostage. This virus copies your files and deletes the original ones and then changes the file extensions of your files so that you cannot open them. This ransomware not only encrypts your personal files, but also may change your desktop wallpaper. And JokeFromMars ransomware will tell you to make a payment if you want to get back your files. And if you don’t make the payment in time, the ransom will be doubled and even tripled.

By doing so, lots of victims do not have time to think about the problem and give in paying the ransom in order to get back their files. But you should know that hackers have encrypted your files and no one can promise that they will decrypt your files after they receive the money. What you can do now is to first remove JokeFromMars ransomware virus from your computer and then get back your files. Otherwise, this ransomware can still encrypt your new files. To avoid such ransomware viruses in the future, you have to be careful and do not open any malicious attachments from spam emails and download files from malicious sources. And always back up your files with your flash drives or online backup services. Now follow the steps below to get rid of this nasty JokeFromMars ransomware virus.

How to remove JokeFromMars Ransomware and decrypt the encrypted files

1. Restore your computer to previous state

Step 1: Boot your PC into Safe Mode with Command Prompt.

Different Operating Systems have different ways to bring up the Safe Mode with Command Prompt.

On XP, Vista and Windows 7

1. To enter Safe Mode with Command Prompt, you should press F8 on your keyboard continually while you are starting your system.

2. When the Windows Advanced Options menu shows up, select Safe Mode with Command Prompt by using the arrow keys and hit Enter.

On Windows 8, 8.1 and Windows 10

1. When you are at login screen, click the Power button.

2. Hit Shift and hold it and click Restart button at the same time.

3. Select Troubleshoot.

4. Then choose Advanced options.

5. Click Startup Settings.

6. Click Restart.

7. When the system is rebooting, choose Enable Safe Mode with Command Prompt by pressing F6.

Step 2: After entering Safe Mode with Command Prompt, you can restore the system now.

1. Type cd restore and hit Enter.
cd restore

2. Then, type rstrui.exe, and also hit Enter.

3. Click on Next when you see the window appears.

4. Choose the Restore Point which was infected with JokeFromMars Ransomware and click on Next to begin restoring the system.

5. Click on Finish to continue.

6. When you click on Finish button, you will be asked to confirm again. Click Yes if you want to do it.

2. Remove JokeFromMars Ransomware from the PC thoroughly

When the restore system is done, you are be advised to do a system scan with this malware detect tool to make sure the ransomware virus is removed completely.

3. Decrypt files encrypted by JokeFromMars ransomware via Shadow Volume Copies

If you use Windows XP service Pack 2, Vista, 7 & 8, you can use the following ways: Shadow Explorer or native Windows Previous Versions to restore the files through Shadow Volume Copies

Shadow Explorer

1. Run Shadow Explorer.
2. Select the drive and folder which you want to restore from the left top corner.
3. Right click the folder as you want to restore and choose Export.
4. Then select the export files location to store them.

Native Windows Previous Versions

Please right click one of the file which has been encrypted and choose Properties, and then navigate to Previous Versions tab. After that, all copies of this selected file and when it was saved in a Shadow Volume Copy will be displayed for you. Select the retrieved file which you want and click Copy, or click Restore. To read more content of this file, you can click on Open.

Comments are closed.