Severity scale:  
  (98/100)

PewDiePie ransomware. How to remove? (Uninstall guide)

removal by Lucia Danes - - | Type: Ransomware

PewDiePie ransomware – a screenlocker which was created to threaten users

PewDiePie virus
PewDiePie virus is ransomware which has been created in a form of a joke to support the well-known YouTuber PewDiePie.

PewDiePie ransomware is a file locking cyber threat which, according to Malware Hunter Team, belongs to ShellLocker ransomware family. Some cybersecurity researchers have been speculating that this malware was created like a joke or for supporting the well-known Youtuber PewDiePie[1] who is known for the biggest number of subscribers and only a new channel named TSeries is one step below this social persona.[2] These speculations appeared because, once infected with PewDiePie virus, the victim receives a note urging him/her to subscribe to PewDiePie's channel. It looks like the ransomware uses the .hwuwhdw appendix to lock files and the only way to recover them is by clicking on the link given below. You can notice this cyber threat from the PewDiePie.exe process running in the system. Even though this type of activity might seem harmless, you should avoid any contact with the crooks and do not click on any dubious links as the criminals might try to convince you to pay them a particular amount of money.

Name  PewDiePie 
Type Ransomware
Related to ShellLocker
Purpose To threaten users and convince them to click on a specific link where you can subscribe to PewDiePie on Youtube
Appendix .hwuwhdw
Ransom note No particular price is urged, the victims are asked to click on a specific link only to subscribe to Youtuber's channel
Main File PewDiePie.exe
Removal Use a tool such as Reimage to detect all rogue components, and complete the virus removal automatically

When infected with ransomware, victims receive this type of message:

You Have Been Fucked By PewDiePie RansomWare.

You have 2 days to help PewDiePie win the battle against
TSeries by subscribing.
The only thing you have to do is to follow the link given
below.

As you can see, the cybercriminals give two days to click on the below-given hyperlink. Even though no ransom price is urged, you should avoid doing anything the crooks say, otherwise, you might put yourself into some trouble. If you have spotted some encrypted files and there is no rush for unlocking them, you should remove PewDiePie virus and take a look at some data recovery tips that you can find below this article. Make sure to choose the most suitable method.

Cryptolockers, such as PewDiePie ransomware, are known for using unique encryption[3] algorithms to lock up important documents that are stored on the infected PC. Crooks often use AES, RSA, or SHA keys which allow to block files and turn them unusable. These codes can be hard to identify as the algorithm differs each time. However, this definitely does not mean that you have to rush and do everything the crooks say in order to restore your files back.

Perform the PewDiePie ransomware removal by using automatical tools only. Manual elimination is not a wise option for this case as the file locking virus might hide various components, files, and run rogue processes in the system that can be missed by the user's eye. Furthermore, our cybersecurity experts recommend using a reliable computer tool such as Reimage to detect all malware-laden content that might be secretly hidden anywhere in your computer system.

Note that it is strongly recommended to get rid of PewDiePie ransomware ASAP. According to computer specialists from Virusai.lt,[4] such viruses might have various damaging abilities. Ransomware might modify the Registry by injecting dubious entries, it can leave malware-related content in the system which might cause even more harm. Furthermore, some cryptolockers are even capable of avoiding antivirus detection or injecting other malware forms.

Ransomware infections can spread thru phishing emails or P2P sites

If you have been infected with a ransomware virus, there are a few possible ways from where this cyber threat might have come from. It is known that various free file sharing and software downloading websites can distribute such malware. For example, Torrents, eMule, The Pirates Bay, and other third-party sources might be the source of ransomware viruses. We suggest avoiding these types of websites, better download software only from original pages and hyperlinks.

Moreover, file locking viruses can come from phishing email messages. In order to avoid such secret installation, you should always:

  • Check the sender. If it comes from an unrecognizable one, do not even consider opening the message or its rogue attachments. 
  • Check the email for grammar mistakes. If it contains many, there is a big possibility that such letter was sent for illegal purposes as official organizations write their emails with no mistakes included.
  • Think if you were expecting to receive anything lately. If not, consider deleting the email letter and all its attachments permanently in order to avoid possible damaging activities.

Get rid of PewDiePie ransomware

If you have been infected with this dangerous-looking cyber threat, you should consider removing it. Perform the PewDiePie ransomware removal by using reputable tools only. Furthermore, we suggest downloading and installing computer software such as Reimage, Malwarebytes MalwarebytesCombo Cleaner, or Plumbytes Anti-MalwareMalwarebytes Malwarebytes. These programs will scan the entire system and search for all malware-laden content that might be intruding the computing work or damaging the system.

Furthermore, it is recommendable to boot your computer to Safe Mode with Networking or use the System Restore feature to disable all harmful activities. After you remove PewDiePie virus, make sure you perform some system backups to check if all rogue content has vanished successfully. Furthermore, you can try recovering locked files by performing some data recovery methods which you can reach below.

Offer
do it now!
Download
Reimage (remover) Happiness
Guarantee
Download
Reimage (remover) Happiness
Guarantee
Compatible with Microsoft Windows Supported versions Compatible with OS X Supported versions
What to do if failed?
If you failed to remove virus damage using Reimage, submit a question to our support team and provide as much details as possible.
Reimage is recommended to remove virus damage. Free scanner allows you to check whether your PC is infected or not. If you need to remove malware, you have to purchase the licensed version of Reimage malware removal tool.
Alternative Software
Different security software includes different virus database. If you didn’t succeed in finding malware with Reimage, try running alternative scan with Malwarebytes.
Alternative Software
Different security software includes different virus database. If you didn’t succeed in finding malware with Reimage, try running alternative scan with Combo Cleaner.

To remove PewDiePie virus, follow these steps:

Remove PewDiePie using Safe Mode with Networking

Use Safe Mode with Networking function to disable the ransomware virus on your computer:

  • Step 1: Reboot your computer to Safe Mode with Networking

    Windows 7 / Vista / XP
    1. Click Start Shutdown Restart OK.
    2. When your computer becomes active, start pressing F8 multiple times until you see the Advanced Boot Options window.
    3. Select Safe Mode with Networking from the list Select 'Safe Mode with Networking'

    Windows 10 / Windows 8
    1. Press the Power button at the Windows login screen. Now press and hold Shift, which is on your keyboard, and click Restart..
    2. Now select Troubleshoot Advanced options Startup Settings and finally press Restart.
    3. Once your computer becomes active, select Enable Safe Mode with Networking in Startup Settings window. Select 'Enable Safe Mode with Networking'
  • Step 2: Remove PewDiePie

    Log in to your infected account and start the browser. Download Reimage or other legitimate anti-spyware program. Update it before a full system scan and remove malicious files that belong to your ransomware and complete PewDiePie removal.

If your ransomware is blocking Safe Mode with Networking, try further method.

Remove PewDiePie using System Restore

Activate System Restore to get rid of the malicious activity. Use these instructions if help is needed:

  • Step 1: Reboot your computer to Safe Mode with Command Prompt

    Windows 7 / Vista / XP
    1. Click Start Shutdown Restart OK.
    2. When your computer becomes active, start pressing F8 multiple times until you see the Advanced Boot Options window.
    3. Select Command Prompt from the list Select 'Safe Mode with Command Prompt'

    Windows 10 / Windows 8
    1. Press the Power button at the Windows login screen. Now press and hold Shift, which is on your keyboard, and click Restart..
    2. Now select Troubleshoot Advanced options Startup Settings and finally press Restart.
    3. Once your computer becomes active, select Enable Safe Mode with Command Prompt in Startup Settings window. Select 'Enable Safe Mode with Command Prompt'
  • Step 2: Restore your system files and settings
    1. Once the Command Prompt window shows up, enter cd restore and click Enter. Enter 'cd restore' without quotes and press 'Enter'
    2. Now type rstrui.exe and press Enter again.. Enter 'rstrui.exe' without quotes and press 'Enter'
    3. When a new window shows up, click Next and select your restore point that is prior the infiltration of PewDiePie. After doing that, click Next. When 'System Restore' window shows up, select 'Next' Select your restore point and click 'Next'
    4. Now click Yes to start system restore. Click 'Yes' and start system restore
    Once you restore your system to a previous date, download and scan your computer with Reimage and make sure that PewDiePie removal is performed successfully.

Bonus: Recover your data

Guide which is presented above is supposed to help you remove PewDiePie from your computer. To recover your encrypted files, we recommend using a detailed guide prepared by 2-spyware.com security experts.

If your files are encrypted by a file locking cyber threat, try using the below-provided methods to bring your documents back to their starter positions.

If your files are encrypted by PewDiePie, you can use several methods to restore them:

Try using Data Recovery Pro to unlock important files:

Use this tool to get files back. Complete each step as shown in the instructing method and you might be able to recover some of your data.

  • Download Data Recovery Pro;
  • Follow the steps of Data Recovery Setup and install the program on your computer;
  • Launch it and scan your computer for files encrypted by PewDiePie ransomware;
  • Restore them.

Windows Previous Versions feature might be a helpful tool:

Use this third-party software if you have enabled the System Restore feature in the past.

  • Find an encrypted file you need to restore and right-click on it;
  • Select “Properties” and go to “Previous versions” tab;
  • Here, check each of available copies of the file in “Folder versions”. You should select the version you want to recover and click “Restore”.

Shadow Explorer might recover some files:

If you cannot bring your data back, you can try this method also. Note that, this tool might only work if the virus did not eliminate Shadow Volume Copies of encrypted data.

  • Download Shadow Explorer (http://shadowexplorer.com/);
  • Follow a Shadow Explorer Setup Wizard and install this application on your computer;
  • Launch the program and go through the drop down menu on the top left corner to select the disk of your encrypted data. Check what folders are there;
  • Right-click on the folder you want to restore and select “Export”. You can also select where you want it to be stored.

Sadly, there is no official PewDiePie ransomware decryptor discovered yet.

Finally, you should always think about the protection of crypto-ransomwares. In order to protect your computer from PewDiePie and other ransomwares, use a reputable anti-spyware, such as Reimage, Malwarebytes MalwarebytesCombo Cleaner or Plumbytes Anti-MalwareMalwarebytes Malwarebytes

About the author

Lucia Danes
Lucia Danes - Virus researcher

If this free removal guide helped you and you are satisfied with our service, please consider making a donation to keep this service alive. Even a smallest amount will be appreciated.

Contact Lucia Danes
About the company Esolutions

References


Your opinion regarding PewDiePie ransomware