Severity scale:  
  (43/100)

Pewcrypt ransomware. How to remove? (Uninstall guide)

removal by Linas Kiguolis - - | Type: Ransomware

Pewcrypt ransomware – a virus that is created to increase sub count for the famous YouTube star PewDiePie

Pewcrypt ransomware
Pewcrypt ransomware is a file locker that was created in order to make users subscribe to PewDiePie's YouTube channel

Pewcrypt ransomware is a file locking malware that is not created for money extortion purposes, unlike most of the other crypto-viruses are. The author, who is most likely a fan of a popular YouTuber PewDiePie, asks users to subscribe to his channel in order to surpass the sub count of the of Indian channel that uploads Bollywood movie trailers. Allegedly, the hacker claims that decryptor will be released as soon as the favorite YouTuber gets 100 million subscribers. Pewcrypt ransomware is written in Java programming language and uses AES-256 to encrypt data, and then RSA-2048 encryption for the key. Once the process is complete, all pictures, music, databases, documents and other data receives an extension .PewCrypt and becomes inaccessible for victims. Victims of malware are also introduced with a pop-up window which explains what happened to users' data and also displays T-Series and PewDiePie sub count. However, ransomware author, who goes by the name __JustMe__ on Twitter, has released the decryption tool for everybody to use for free.

Name  Pewcrypt
Type  Ransomware
Written in  Java
Related files  PewCrypt.exe, javaw.exe, icacls.exe, conhost.exe
Virus relations  PewDiePie ransomware
Author   __JustMe__
File extension .PewCrypt
Decryptable?  Yes. Emsisoft has released the original decryptor for this ransomware. Also, the ransomware author himself has released the tool PewDecrypt.exe. It can be downloaded here.
Removal  Use reputable anti-malware software
Recovery  To recover from virus damage, scan your machine with Reimage

Considering the immense popularity of this YouTuber (he has been the most subscribed blogger on the platform for over five years), it is not surprising that hackers are creating malware like Pewcrypt or PewDiePie ransomware. However, while in most cases cybercriminals use malicious actions to extort money from users, these viruses do not ask for that. Instead, they want victims to subscribe to PewDiePie.

Being a fan of somebody is OK, but corrupting users' personal files for the sake of the popularity of the YouTuber is purely malicious, and should still be treated negatively. We must give the author credit for releasing the decryptor for free, however. Nevertheless, you need to remove Pewcrypt ransomware before you can use the tool, as all the data will be encrypted repeatedly.

Once the Pewcrypt virus settles, it heavily modifies various Windows settings, spawns multiple processes, attempts to shut down security applications, writes to Windows registry, injects new processes, etc. This ensures that malware will be launched with every system startup.

As soon as file encryption is complete and .Pewcrypt extension is added to most of the files (note that malware skips files larger than 20MB, as well as .exe, .jar and .dll extensions) users can see a ransom note in a pop-up window, which states:

Your files have been encrypted using a 256 bit AES key which has been encrypted with a 2048 bit RSA key
In order to get your files back read the instructions bellow

Instructions:
 – Subscribe to Pewdiepie (Hint: Hit the bro fist)
 – Wait until Pewdiepie reaches 100 million subs at which point a decryption tool will be realseaed
If T-Series beats Pewdiepie THE PRIVATE KEY WILL BE DELETED AND YOU FILES GONE FOREVER!

It is up to you whether or not you want to subscribe to the channel, as it will not change to your personally. For the moment, you need to focus on Pewcrypt ransomware removal. In the early stages of the discovery, researchers warned that only 2 AV engines detected the threat.[1] However, Virus Total results currently show that the malicious file is detected by 30 vendors under names like Trojan.GenericKD.41039316, Ransom_Agent.R002C0OBP19, PUA:Win32/Presenoker, Java/Filecoder.AF!tr., Win32:Trojan-gen, etc.[2]

Once you eliminate Pewcrypt ransomware from your PC, make sure you scan it with Reimage. It will be able to fix damaged Windows Registry and revert all the damage done to the operating system. Finally, you can use the decryptor released by the author to recover files, although backups and third-party tools are also available for PewCrypt ransomware decryption.

Pewcrypt ransomware virus
Pewcrypt ransomware is malware, written in Java, that locks ups data and does not demands ransom for file release. Fortunately, virus author released the decryptor (it should only be used after virus removal, however)

Be attentive while browsing the internet to avoid malware infections

Quite often, users do not take cybersecurity seriously, as they are mostly not aware of the consequences that various malware infection can induce to not only computer but also the user. Simply put, in case of ransomware infection you might lose your files permanently, which can be non-impactful to some but devastating to others (for example, several businesses that suffered ransomware attacks hard to rebuild the infrastructure from scratch, an operation which costs millions).[3]

Finally, such items like photos can bring a lot of memories and are invaluable. Thus, many people risk losing hundreds of dollars and pay ransom to crooks. As usually it is not recommended, as the chance of getting scammed is very high. Instead, try not to get infected in the first place:

  • Use reputable security software with real-time protection feature;
  • Patch your system as soon security updates are released;
  • Do not run Flash Player and Java plugins, or set it to click-to-play;
  • Beware of bundled software, as it can sometimes include malware;
  • Stay away from high-risk sites like porn, gambling, torrents, etc.;
  • Do not click on links or attachments inside suspicious spam emails.

Eliminate Pewcrypt ransomware before you proceed with file recovery

As we already mentioned, you need to make sure that Pewcrypt ransomware removal is performed before you attempt to recover your personal data like pictures, music, videos, databases, documents, etc. For that, you will have to use a security application that can detect and eliminate the threat.

As Pewcrypt virus uses obfuscation and evasion techniques, it is highly recommended entering Safe Mode with Networking first. The safe environment will ensure that malware[4] is not running in the background and it will not interfere with anti-virus application.

Once you remove Pewcrypt ransomware, use backups to restore your files safely. In case you never prepared any – take advantage of decryptor released by malware author. Finally, you can try third-party tools if nothing else helps.

Offer
do it now!
Download
Reimage (remover) Happiness
Guarantee
Download
Reimage (remover) Happiness
Guarantee
Compatible with Microsoft Windows Supported versions Compatible with OS X Supported versions
What to do if failed?
If you failed to remove virus damage using Reimage, submit a question to our support team and provide as much details as possible.
Reimage is recommended to remove virus damage. Free scanner allows you to check whether your PC is infected or not. If you need to remove malware, you have to purchase the licensed version of Reimage malware removal tool.
Alternative Software
Different security software includes different virus database. If you didn’t succeed in finding malware with Reimage, try running alternative scan with Malwarebytes.
Alternative Software
Different security software includes different virus database. If you didn’t succeed in finding malware with Reimage, try running alternative scan with Combo Cleaner.

To remove Pewcrypt virus, follow these steps:

Remove Pewcrypt using Safe Mode with Networking

To remove Pewcrypt virus from your machine safely, enter Safe Mode with Networking and perform full system scan using security software:

  • Step 1: Reboot your computer to Safe Mode with Networking

    Windows 7 / Vista / XP
    1. Click Start Shutdown Restart OK.
    2. When your computer becomes active, start pressing F8 multiple times until you see the Advanced Boot Options window.
    3. Select Safe Mode with Networking from the list Select 'Safe Mode with Networking'

    Windows 10 / Windows 8
    1. Press the Power button at the Windows login screen. Now press and hold Shift, which is on your keyboard, and click Restart..
    2. Now select Troubleshoot Advanced options Startup Settings and finally press Restart.
    3. Once your computer becomes active, select Enable Safe Mode with Networking in Startup Settings window. Select 'Enable Safe Mode with Networking'
  • Step 2: Remove Pewcrypt

    Log in to your infected account and start the browser. Download Reimage or other legitimate anti-spyware program. Update it before a full system scan and remove malicious files that belong to your ransomware and complete Pewcrypt removal.

If your ransomware is blocking Safe Mode with Networking, try further method.

Remove Pewcrypt using System Restore

System Restore can also be used to stop the virus:

  • Step 1: Reboot your computer to Safe Mode with Command Prompt

    Windows 7 / Vista / XP
    1. Click Start Shutdown Restart OK.
    2. When your computer becomes active, start pressing F8 multiple times until you see the Advanced Boot Options window.
    3. Select Command Prompt from the list Select 'Safe Mode with Command Prompt'

    Windows 10 / Windows 8
    1. Press the Power button at the Windows login screen. Now press and hold Shift, which is on your keyboard, and click Restart..
    2. Now select Troubleshoot Advanced options Startup Settings and finally press Restart.
    3. Once your computer becomes active, select Enable Safe Mode with Command Prompt in Startup Settings window. Select 'Enable Safe Mode with Command Prompt'
  • Step 2: Restore your system files and settings
    1. Once the Command Prompt window shows up, enter cd restore and click Enter. Enter 'cd restore' without quotes and press 'Enter'
    2. Now type rstrui.exe and press Enter again.. Enter 'rstrui.exe' without quotes and press 'Enter'
    3. When a new window shows up, click Next and select your restore point that is prior the infiltration of Pewcrypt. After doing that, click Next. When 'System Restore' window shows up, select 'Next' Select your restore point and click 'Next'
    4. Now click Yes to start system restore. Click 'Yes' and start system restore
    Once you restore your system to a previous date, download and scan your computer with Reimage and make sure that Pewcrypt removal is performed successfully.

Bonus: Recover your data

Guide which is presented above is supposed to help you remove Pewcrypt from your computer. To recover your encrypted files, we recommend using a detailed guide prepared by 2-spyware.com security experts.

If your files are encrypted by Pewcrypt, you can use several methods to restore them:

Data Recovery pro might help with encrypted files

This recovery tool can sometimes recover files that are encrypted by ransomware virus.

  • Download Data Recovery Pro;
  • Follow the steps of Data Recovery Setup and install the program on your computer;
  • Launch it and scan your computer for files encrypted by Pewcrypt ransomware;
  • Restore them.

Windows Previous versions feature might be useful

If you had System Restore enabled before Pewcrypt ransomware struck, you might be able to recover some of your files separately.

  • Find an encrypted file you need to restore and right-click on it;
  • Select “Properties” and go to “Previous versions” tab;
  • Here, check each of available copies of the file in “Folder versions”. You should select the version you want to recover and click “Restore”.

Take advantage of ShadowExplorer

If ransomware failed to remove Shadow Volume Copies, use ShadowExplorer to restore all your data.

  • Download Shadow Explorer (http://shadowexplorer.com/);
  • Follow a Shadow Explorer Setup Wizard and install this application on your computer;
  • Launch the program and go through the drop down menu on the top left corner to select the disk of your encrypted data. Check what folders are there;
  • Right-click on the folder you want to restore and select “Export”. You can also select where you want it to be stored.

Use decryption tool released by the virus author

Download decryptor released by malware author here. Download decryptor released by the cybersecurity company Emsisoft here.

Finally, you should always think about the protection of crypto-ransomwares. In order to protect your computer from Pewcrypt and other ransomwares, use a reputable anti-spyware, such as Reimage, Malwarebytes MalwarebytesCombo Cleaner or Plumbytes Anti-MalwareMalwarebytes Malwarebytes

About the author

Linas Kiguolis
Linas Kiguolis - Expert in social media

If this free removal guide helped you and you are satisfied with our service, please consider making a donation to keep this service alive. Even a smallest amount will be appreciated.

Contact Linas Kiguolis
About the company Esolutions

References