JohnyCryptor Virus Ransomware Removal (Decryption Methods Included)

The encrypted files may not be the only damage done to you. parasite may still be hiding on your PC. To determine whether you've been infected with ransomware, we recommend downloading SpyHunter.

Download SpyHunter Anti-Malware

More information on SpyHunter, steps to uninstallEULAThreat Assessment Criteria, and Privacy Policy.

This page aims to help you remove JohnyCryptor Ransomware. These JohnyCryptor Ransomware removal instructions work for all versions of Windows.

Dear User,

The reason why you have come across this article and why we have assembled it is JohnyCryptor. Maybe you have done some research and you have realized that this is the program that has been harassing you for some time now. When it comes to JohnyCryptor, we should first mention that it is a member of the family of the Ransomware viruses.  Unfortunately, this virus and its relatives are among the most disturbing and dangerous ones ever known to users.

Basic ways of working of JohnyCryptor

All popular Ransomware-based programs in fact work in a similar way. They are distributed along with Trojan horse viruses inside emails, torrents, shareware and text documents. Actually, the Trojans are the ones that use the vulnerabilities of your operating system or any other installed program on your PC to find a way to let the given Ransomware in. Such a weakness can be the lack of an anti-malware tool or having one that is not top-quality and doesn’t function well enough. Once these two “friends” are INSIDE your PC, the Trojan stays there, hiding itself from you. However, JohnyCryptor goes straight to business. What it first starts doing is to perform a scan of all your memory devices to try to determine which data you most regularly use. After that a list with all such files is created and the actual encryption process starts taking place. The encryption process consists of putting your most often visited files behind two levels of bars. The first level is the so-called public encryption key. The hackers usually give it to you once they are done with the whole encoding process. The second level of encryption is the one you should be concerned about, as you need to pay for this key. The second key is called private. You can only receive it after completing a payment of an amount of money. At the end of the encryption process, an informative notification is shown on your computer screen, giving you the info about the infection as well as payment details about the demanded ransom. Unfortunately, the displayed alert is completely real – your files have been encoded and even experts find it difficult to fight such programs. That’s why this kind of software is called Ransomware – it in fact tries to extort money from the affected users. It is a kind of blackmailing, if you will.

Is there any possible way to remove JohnyCryptor and recover your access to the hijacked data?

Of course, it is possible to remove it. That is why we have created a guide with removal instructions to help you with that. However, even if you manage to uninstall the virus successfully, it still doesn’t mean that your files are free to be accessed by you again. The removal of JohnyCryptor is not an equivalent to the actual restoration of your encrypted files. They may remain locked up forever. Nevertheless, this should not make you more willing to pay the requested ransom. Even if you give your money to the cyber criminals, who are harassing you, you still may receive nothing in return. You may never get the private component of the encryption key. That’s what makes JohnyCryptor so alarmingly dangerous. Being infected with that virus, you simply never know what you should or should not do. It is your decision to pay or to avoid paying. In both of the cases, you will risk your files.

Our advice is to never put your trust into the greedy hackers that have been indecent enough to contaminate your PC with such a nasty virus. Avoid paying the requested ransom for as much time as you can. Go and discuss the matter with a professional who may know what to do with JohnyCryptor. Do not give in to the criminals’ demands very easily and too soon. Try to do something to save your files.

Maybe you are now interested in some prevention advice that actually works

Most of the prevention tips we are going to give to you are general and may save you from Ransomware and other dangerous viruses. Some of them are specific and regard only the distribution of this specific kind. Let’s begin with avoiding the suspicious emails you may receive from senders you cannot recognize. This is the most common way of spreading JohnyCryptor. Do not open such letters, ever.  Another important piece of advice is to never download any software from places on the web that do not seem trustworthy enough to you. Even if you download a bundle or a single program, mind the installation option that you use. Install only in the Custom or the Advanced way. What’s more, explore your PC and the programs installed on it for any weaknesses and try to repair them.


Name JohnyCryptor
Type Ransomware
Danger Level High (Ransomware is by far the worst threat you can encounter)
Symptoms Usually there might be a slowdown during the encryption process, however, the only visible symptom is often just the ransom notification.
Distribution Method Contaminated letters and their attachments from your email. Text documents, torrents and shareware could also be sources.
Detection Tool JohnyCryptor may be difficult to track down. Use SpyHunter – a professional parasite scanner – to make sure you find all files related to the infection.

Keep in mind, SpyHunter’s malware detection tool is free. To remove the infection, you’ll need to purchase the full version.
More information about SpyHunter and steps to uninstall.

JohnyCryptor Ransomware Removal


Reboot in Safe Mode (use this guide if you don’t know how to do it).

This is the first preparation.


To remove parasite on your own, you may have to meddle with system files and registries. If you were to do this, you need to be extremely careful, because you may damage your system.

If you want to avoid the risk, we recommend downloading SpyHunter
a professional malware removal tool.

More information on SpyHunter, steps to uninstallEULAThreat Assessment Criteria, and Privacy Policy.

Type msconfig in the search field and hit enter. A window will pop-up:


Go in Startup —> Uncheck entries that have “Unknown” as Manufacturer.

  • Please note that ransomware may even include a fake Manufacturer name to its process. Make sure you check out every process here is legitimate.


Press CTRL + SHIFT + ESC simultaneously. Go to the Processes Tab. Try to determine which ones are a virus. Google them or ask us in the comments.


We get asked this a lot, so we are putting it here: Removing parasite manually may take hours and damage your system in the process. We recommend downloading SpyHunter to see if it can detect parasite files for you.

Right click on each of the virus processes separately and select Open File LocationEnd the process after you open the folder, then delete the directories you were sent to.



Type Regedit in the windows search field and press EnterOnce inside, press CTRL and F together and type the virus’s Name. 

Search for the ransomware  in your registries and delete the entries. Be extremely careful –  you can damage your system if you delete entries not related to the ransomware.

Type each of the following in the Windows Search Field:

  1. %AppData%
  2. %LocalAppData%
  3. %ProgramData%
  4. %WinDir%
  5. %Temp%

Delete everything in Temp. The rest just check out for anything recently added. Remember to leave us a comment if you run into any trouble!


How to Decrypt files infected with JohnyCryptor

We have a comprehensive (and daily updated) guide on how to decrypt your files. Check it out here.

Did we help? Share your feedback with us so we can help other people in need!

Leave a Comment