How to Recover Files Encrypted by Jaff Ransomware?

by Olivia Morelli - -


Issue: How to Recover Files Encrypted by Jaff Ransomware?

Hello, today my files were encrypted by a malicious computer virus called Jaff ransomware. It has corrupted all files and added .sVn file extensions to them. I heard that there is a decrypter for earlier versions of this ransomware, the ones that were using .wlu or .jaff file extensions. Is there any way to decrypt .sVn files for free?

Solved Answer

Decrypt data encoded by Jaff ransomware

Jaff ransomware virus is a malicious computer program that is rapidly distributed with a help of Necurs botnet. Currently, there are three versions of the ransomware, and each of them adds different file extensions and uses different names for the ransom notes:

  • .jaff file extension virus used to drop ReadMe.txt, ReadMe.html and ReadMe.bmp file;
  • .wlu file extension virus dropped these files: README_TO_DECRYPTI.txt, README_TO_DECRYPTl.bmp, README_TO_DECRYPT.html;
  • .sVn file extension virus uses the following names for the ransom notes: !!!!README_FOR_SAVE FILES.txt and !!!SAVE YOUR FILES.bmp. The latest variants leave !!!!!SAVE YOUR FILES!!!!.txt and !!!SAVE YOUR FILES!.bmp files.

While some security researchers believed that it might be a variant of Locky ransomware, others proved them wrong. In fact, the virus seemed to be extremely dangerous and sophisticated, although experts from Kaspersky proved that it is only the appearance of the virus that was scary. Jaff decryption tool is available, and it works for all versions of the virus, including .jaff, .wlu, and .sVn variants. If your files were encrypted, you must complete some tasks in a specific order if you want to recover your data and continue using it successfully.

Step 1. Remove Jaff ransomware completely

Recover now! Recover now!
To recover needed system components, please, purchase the licensed version of Reimage Reimage recovery tool.
  • Before you try to decrypt your files, remove the ransomware so that it could not interfere with the decryption process.
  • Reboot your PC into Safe Mode (see a guide on how to do it here) and launch anti-spyware software such as Reimage. Scan the system with it.
  • Remove detected malware and related components.

Step 2. Restore .jaff, .wlu, .sVn file extension files

Recover now! Recover now!
To recover needed system components, please, purchase the licensed version of Reimage Reimage recovery tool.

Method 1. Recover your files using RakhniDecryptor

  1. Download RahkniDecryptor from official Kaspersky website.
  2. Check if the decryptor’s version is (or higher).
  3. Click Start scan and then choose the folder that contains files you want to decrypt.
  4. The decryptor should ask you to select a ransom note. Find it, select it and click Open.
  5. Wait until the decryptor restores all files from your selected folder.
  6. Repeat 3-5 step with every folder that contained important files.

In case you were infected with an updated version of the Jaff malware, the decryptor might now work. In such case, try one of the following techniques:

Method 2. Run a scan with Data Recovery Pro

  1. Install Data Recovery Pro according to information provided by its installer.
  2. Launch it and scan the system to detect files that can be recovered.
  3. Restore them.

Method 3. Use Volume Shadow Copies

Volume Shadow Copies can be used in case the computer virus leaves them on the system after encrypting all files. The majority of such malicious programs delete these copies so that the victim couldn’t recover encrypted files without paying the ransom. We have already provided a comprehensive guide on how to restore files using Shadow Volume Copies.

Recover files and other system components automatically

To recover your files and other system components, you can use free guides by experts. However, if you feel that you are not experienced enough to implement the whole recovery process yourself, we recommend using recovery solutions listed below. We have tested each of these programs and their effectiveness for you, so all you need to do is to let these tools do all the work.

do it now!
recovery software Happiness
do it now!
recovery software Happiness
Compatible with Microsoft Windows Compatible with OS X
Do you have any trouble?
If you are having problems related to Reimage, you can reach our tech experts to ask them for help. The more details you provide, the better solution they will provide you.
Reimage - a patented specialized Windows repair program. It will diagnose your damaged PC. It will scan all System Files, DLLs and Registry Keys that have been damaged by security threats.Reimage - a patented specialized Mac OS X repair program. It will diagnose your damaged computer. It will scan all System Files and Registry Keys that have been damaged by security threats.
This patented repair process uses a database of 25 million components that can replace any damaged or missing file on user's computer.
To repair damaged system, you have to purchase the licensed version of Reimage malware removal tool.

Prevent websites, ISP, and other parties from tracking you

Private Internet Access is a VPN that can prevent your Internet Service Provider, the government, and third-parties from tracking your online and allow you to stay completely anonymous. The software provides dedicated servers for torrenting and streaming, ensuring optimal performance and not slowing you down. You can also bypass geo-restrictions and view such services as Netflix, BBC, Disney+, and other popular streaming services without limitations, regardless of where you are.

A VPN is also crucial when it comes to user privacy. Online trackers such as cookies can not only be used by social media platforms and other websites but also your Internet Service Provider and the government. Even if you apply the most secure settings via your web browser, you can still be tracked via apps that you are connected to the internet. Besides, privacy-focused browsers like Tor is are not an optimal choice due to diminished connection speed.

Therefore, to stay completely anonymous and prevent the ISP and the government from spying on you, you should employ Private Internet Access VPN. It will allow you to connect to the internet while being completely anonymous, prevent trackers, ads, as well as malicious content. Most importantly, you will prevent the illegal surveillance activities that NSA and other governmental institutions are performing behind your back.


Recover your lost files quickly

Unforeseen circumstances can happen at any time while using the computer: it can turn off due to a power cut, a Blue Screen of Death (BSoD) can occur, or random Windows updates can decide to reboot the machine when you went away for a few minutes. As a result, your schoolwork, important documents, and other data might be lost.

Additionally, you might also be attacked by malware that can corrupt your Windows or encrypt files with a robust encryption algorithm, and ask for a ransom in Bitcoin for the decryption tool. Cybercriminals might not deliver what they promised, however, so it is better to attempt alternative file recovery methods that could help you to retrieve at least some portion of the lost data.

Data recovery software is one of the options that could help you recover your files. Once you delete a file, it does not vanish into thin air – it remains on your system as long as no new data is written on top of it. Data Recovery Pro is recovery software that searchers for working copies of deleted files within your hard drive. By using the tool, you can prevent loss of valuable documents, school work, personal pictures, and other crucial files.

About the author
Olivia Morelli
Olivia Morelli - PC & Mac repair expert

Olivia Morelli is a young, but a perspicacious IT expert who is currently just a year away from a Bachelor’s Degree in Software Systems. Her primary passion is cyber security, however, thanks to her detailed understanding of computer networks, operating systems and hardware, she can find a fix for any PC or Mac issue...

Contact Olivia Morelli
About the company Esolutions

What you can add more about the problem: "How to Recover Files Encrypted by Jaff Ransomware?"