Pewcrypt ransomware (Virus Removal Guide) - Decryption Steps Included
Pewcrypt virus Removal Guide
What is Pewcrypt ransomware?
Pewcrypt ransomware – a virus that is created to increase sub count for the famous YouTube star PewDiePie
Pewcrypt ransomware is a file locker that was created in order to make users subscribe to PewDiePie's YouTube channel
Pewcrypt ransomware is a file locking malware that is not created for money extortion purposes, unlike most of the other crypto-viruses are. The author, who is most likely a fan of a popular YouTuber PewDiePie, asks users to subscribe to his channel in order to surpass the sub count of the of Indian channel that uploads Bollywood movie trailers. Allegedly, the hacker claims that decryptor will be released as soon as the favorite YouTuber gets 100 million subscribers. Pewcrypt ransomware is written in Java programming language and uses AES-256 to encrypt data, and then RSA-2048 encryption for the key. Once the process is complete, all pictures, music, databases, documents and other data receives an extension .PewCrypt and becomes inaccessible for victims. Victims of malware are also introduced with a pop-up window which explains what happened to users' data and also displays T-Series and PewDiePie sub count. However, ransomware author, who goes by the name __JustMe__ on Twitter, has released the decryption tool for everybody to use for free.
|Related files||PewCrypt.exe, javaw.exe, icacls.exe, conhost.exe|
|Virus relations||PewDiePie ransomware|
|Decryptable?||Yes. Emsisoft has released the original decryptor for this ransomware. Also, the ransomware author himself has released the tool PewDecrypt.exe. It can be downloaded here.|
|Removal||Use reputable anti-malware software|
|Recovery||To recover from virus damage, scan your machine with RestoroIntego|
Considering the immense popularity of this YouTuber (he has been the most subscribed blogger on the platform for over five years), it is not surprising that hackers are creating malware like Pewcrypt or PewDiePie ransomware. However, while in most cases cybercriminals use malicious actions to extort money from users, these viruses do not ask for that. Instead, they want victims to subscribe to PewDiePie.
Being a fan of somebody is OK, but corrupting users' personal files for the sake of the popularity of the YouTuber is purely malicious, and should still be treated negatively. We must give the author credit for releasing the decryptor for free, however. Nevertheless, you need to remove Pewcrypt ransomware before you can use the tool, as all the data will be encrypted repeatedly.
Once the Pewcrypt virus settles, it heavily modifies various Windows settings, spawns multiple processes, attempts to shut down security applications, writes to Windows registry, injects new processes, etc. This ensures that malware will be launched with every system startup.
As soon as file encryption is complete and .Pewcrypt extension is added to most of the files (note that malware skips files larger than 20MB, as well as .exe, .jar and .dll extensions) users can see a ransom note in a pop-up window, which states:
Your files have been encrypted using a 256 bit AES key which has been encrypted with a 2048 bit RSA key
In order to get your files back read the instructions bellow
– Subscribe to Pewdiepie (Hint: Hit the bro fist)
– Wait until Pewdiepie reaches 100 million subs at which point a decryption tool will be realseaed
If T-Series beats Pewdiepie THE PRIVATE KEY WILL BE DELETED AND YOU FILES GONE FOREVER!
It is up to you whether or not you want to subscribe to the channel, as it will not change to your personally. For the moment, you need to focus on Pewcrypt ransomware removal. In the early stages of the discovery, researchers warned that only 2 AV engines detected the threat. However, Virus Total results currently show that the malicious file is detected by 30 vendors under names like Trojan.GenericKD.41039316, Ransom_Agent.R002C0OBP19, PUA:Win32/Presenoker, Java/Filecoder.AF!tr., Win32:Trojan-gen, etc.
Once you eliminate Pewcrypt ransomware from your PC, make sure you scan it with RestoroIntego. It will be able to fix damaged Windows Registry and revert all the damage done to the operating system. Finally, you can use the decryptor released by the author to recover files, although backups and third-party tools are also available for PewCrypt ransomware decryption.
Pewcrypt ransomware is malware, written in Java, that locks ups data and does not demands ransom for file release. Fortunately, virus author released the decryptor (it should only be used after virus removal, however)
Be attentive while browsing the internet to avoid malware infections
Quite often, users do not take cybersecurity seriously, as they are mostly not aware of the consequences that various malware infection can induce to not only computer but also the user. Simply put, in case of ransomware infection you might lose your files permanently, which can be non-impactful to some but devastating to others (for example, several businesses that suffered ransomware attacks hard to rebuild the infrastructure from scratch, an operation which costs millions).
Finally, such items like photos can bring a lot of memories and are invaluable. Thus, many people risk losing hundreds of dollars and pay ransom to crooks. As usually it is not recommended, as the chance of getting scammed is very high. Instead, try not to get infected in the first place:
- Use reputable security software with real-time protection feature;
- Patch your system as soon security updates are released;
- Do not run Flash Player and Java plugins, or set it to click-to-play;
- Beware of bundled software, as it can sometimes include malware;
- Stay away from high-risk sites like porn, gambling, torrents, etc.;
- Do not click on links or attachments inside suspicious spam emails.
Eliminate Pewcrypt ransomware before you proceed with file recovery
As we already mentioned, you need to make sure that Pewcrypt ransomware removal is performed before you attempt to recover your personal data like pictures, music, videos, databases, documents, etc. For that, you will have to use a security application that can detect and eliminate the threat.
As Pewcrypt virus uses obfuscation and evasion techniques, it is highly recommended entering Safe Mode with Networking first. The safe environment will ensure that malware is not running in the background and it will not interfere with anti-virus application.
Once you remove Pewcrypt ransomware, use backups to restore your files safely. In case you never prepared any – take advantage of decryptor released by malware author. Finally, you can try third-party tools if nothing else helps.
Getting rid of Pewcrypt virus. Follow these steps
Manual removal using Safe Mode
To remove Pewcrypt virus from your machine safely, enter Safe Mode with Networking and perform full system scan using security software:
Manual removal guide might be too complicated for regular computer users. It requires advanced IT knowledge to be performed correctly (if vital system files are removed or damaged, it might result in full Windows compromise), and it also might take hours to complete. Therefore, we highly advise using the automatic method provided above instead.
Step 1. Access Safe Mode with Networking
Manual malware removal should be best performed in the Safe Mode environment.
Windows 7 / Vista / XP
- Click Start > Shutdown > Restart > OK.
- When your computer becomes active, start pressing F8 button (if that does not work, try F2, F12, Del, etc. – it all depends on your motherboard model) multiple times until you see the Advanced Boot Options window.
- Select Safe Mode with Networking from the list.
Windows 10 / Windows 8
- Right-click on Start button and select Settings.
- Scroll down to pick Update & Security.
- On the left side of the window, pick Recovery.
- Now scroll down to find Advanced Startup section.
- Click Restart now.
- Select Troubleshoot.
- Go to Advanced options.
- Select Startup Settings.
- Press Restart.
- Now press 5 or click 5) Enable Safe Mode with Networking.
Step 2. Shut down suspicious processes
Windows Task Manager is a useful tool that shows all the processes running in the background. If malware is running a process, you need to shut it down:
- Press Ctrl + Shift + Esc on your keyboard to open Windows Task Manager.
- Click on More details.
- Scroll down to Background processes section, and look for anything suspicious.
- Right-click and select Open file location.
- Go back to the process, right-click and pick End Task.
- Delete the contents of the malicious folder.
Step 3. Check program Startup
- Press Ctrl + Shift + Esc on your keyboard to open Windows Task Manager.
- Go to Startup tab.
- Right-click on the suspicious program and pick Disable.
Step 4. Delete virus files
Malware-related files can be found in various places within your computer. Here are instructions that could help you find them:
- Type in Disk Cleanup in Windows search and press Enter.
- Select the drive you want to clean (C: is your main drive by default and is likely to be the one that has malicious files in).
- Scroll through the Files to delete list and select the following:
Temporary Internet Files
- Pick Clean up system files.
- You can also look for other malicious files hidden in the following folders (type these entries in Windows Search and press Enter):
After you are finished, reboot the PC in normal mode.
Remove Pewcrypt using System Restore
System Restore can also be used to stop the virus:
Step 1: Reboot your computer to Safe Mode with Command Prompt
Windows 7 / Vista / XP
- Click Start → Shutdown → Restart → OK.
- When your computer becomes active, start pressing F8 multiple times until you see the Advanced Boot Options window.
- Select Command Prompt from the list
Windows 10 / Windows 8
- Press the Power button at the Windows login screen. Now press and hold Shift, which is on your keyboard, and click Restart..
- Now select Troubleshoot → Advanced options → Startup Settings and finally press Restart.
- Once your computer becomes active, select Enable Safe Mode with Command Prompt in Startup Settings window.
Step 2: Restore your system files and settings
- Once the Command Prompt window shows up, enter cd restore and click Enter.
- Now type rstrui.exe and press Enter again..
- When a new window shows up, click Next and select your restore point that is prior the infiltration of Pewcrypt. After doing that, click Next.
- Now click Yes to start system restore.
Bonus: Recover your dataGuide which is presented above is supposed to help you remove Pewcrypt from your computer. To recover your encrypted files, we recommend using a detailed guide prepared by 2-spyware.com security experts.
If your files are encrypted by Pewcrypt, you can use several methods to restore them:
Data Recovery pro might help with encrypted files
This recovery tool can sometimes recover files that are encrypted by ransomware virus.
- Download Data Recovery Pro;
- Follow the steps of Data Recovery Setup and install the program on your computer;
- Launch it and scan your computer for files encrypted by Pewcrypt ransomware;
- Restore them.
Windows Previous versions feature might be useful
If you had System Restore enabled before Pewcrypt ransomware struck, you might be able to recover some of your files separately.
- Find an encrypted file you need to restore and right-click on it;
- Select “Properties” and go to “Previous versions” tab;
- Here, check each of available copies of the file in “Folder versions”. You should select the version you want to recover and click “Restore”.
Take advantage of ShadowExplorer
If ransomware failed to remove Shadow Volume Copies, use ShadowExplorer to restore all your data.
- Download Shadow Explorer (http://shadowexplorer.com/);
- Follow a Shadow Explorer Setup Wizard and install this application on your computer;
- Launch the program and go through the drop down menu on the top left corner to select the disk of your encrypted data. Check what folders are there;
- Right-click on the folder you want to restore and select “Export”. You can also select where you want it to be stored.
Use decryption tool released by the virus author
Download decryptor released by malware author here. Download decryptor released by the cybersecurity company Emsisoft here.
Finally, you should always think about the protection of crypto-ransomwares. In order to protect your computer from Pewcrypt and other ransomwares, use a reputable anti-spyware, such as RestoroIntego, SpyHunter 5Combo Cleaner or Malwarebytes
How to prevent from getting ransomware
Do not let government spy on you
The government has many issues in regards to tracking users' data and spying on citizens, so you should take this into consideration and learn more about shady information gathering practices. Avoid any unwanted government tracking or spying by going totally anonymous on the internet.
You can choose a different location when you go online and access any material you want without particular content restrictions. You can easily enjoy internet connection without any risks of being hacked by using Private Internet Access VPN.
Control the information that can be accessed by government any other unwanted party and surf online without being spied on. Even if you are not involved in illegal activities or trust your selection of services, platforms, be suspicious for your own security and take precautionary measures by using the VPN service.
Backup files for the later use, in case of the malware attack
Computer users can suffer from data losses due to cyber infections or their own faulty doings. Ransomware can encrypt and hold files hostage, while unforeseen power cuts might cause a loss of important documents. If you have proper up-to-date backups, you can easily recover after such an incident and get back to work. It is also equally important to update backups on a regular basis so that the newest information remains intact – you can set this process to be performed automatically.
When you have the previous version of every important document or project you can avoid frustration and breakdowns. It comes in handy when malware strikes out of nowhere. Use Data Recovery Pro for the data restoration process.
- ^ Leo. PEWDIEPIE RANSOMWARE. Twitter. Social Network.
- ^ PewCrypt.exe. Virus Total. File and URL analyzer.
- ^ Julie Splinters. Maersk needed 10 days to recover from NotPetya attack fully. 2-spyware. Cybersecurity news and articles.
- ^ Malware. Wikipedia. The free encyclopedia.