Pykw ransomware: what it is and how to remove it

From our report of Jun 2020 · not reviewed since

More from our earlier report on Pykw ransomware

• Slow PC, inaccessible personal files, all locked files marked wit .pykw extension, ransom note present on the system
• The ransomware can be disseminated in many ways: spam email attachments, unprotected RDPs, pirated software, cracks, keygens, exploits, etc.
• Unlike Djvu versions launched before August 2019, the current variants are based on online keys that cannot be cracked without paying the ransom
• Although there's no official decryptor, victims are not recommended to pay the ransom for criminals.
• Instead, try to recover .pykw files using alternative methods, including backups, third-party data recovery tools, Volume Shadow Copies.
• Besides, you can give a try for a free Djvu decryptor that is used for unlocking older Djvu variants.
• There's a possibility that it will decrypt at least a part of compromised files
• Ransomware should be eliminated with a powerful anti-virus program.
• NOTE: the virus can block anti-virus tools, so restart the machine into Safe Mode with Networking
• The system's performance may significantly decrease after ransomware installation.

From our report of Jun 2020 · not reviewed since

Pykw is a ransomware virus that adds the .pykw file name to encrypted data and urges victims to pay a Bitcoin ransom

Pykw is the name of a malicious application that corrupts people's personal files stored on the PC once it gets installed.

It has an in-built AES or another encryption algorithm, which uses a sophisticated mathematic cipher to restrict users' access to their data, which cannot be unlocked without a decryption key.

The goal of the Pykw ransomware is to prevent users from accessing the most essential files and then demand them to pay the ransom for the functional decryptor. Such viruses are known as crypto-extortionists, ransomware, file-encoders, and similar names.

At the moment, this particular virus is circulating on the Internet via obfuscated files attacked to pirated software or spam email attachments. Thus, experts urge people to restrain from downloading cracks, such as Adobe Acrobat or Photoshop. Besides, do not open emails that have .ZIP, .EXE, .PDF attachments named something like "Order confirmation".

Genealogically, Pykw ransomware virus belongs to the huge STOP/Djvu ransomware family. Some of the noteworthy members of this gang are Zwer, Nlah, Moba and the rest of 230 variants in total.

The current version marks corrupted files with the .pykw file extension and drop a _readme.txt file as an information "leaflet," which demands victims to pay the ransom $480/790 in Bitcoins and then contact ransomware managers via helpmanager@mail.ch or restoremanager@firemail.cc emails.

Djvu ransomware family is regularly augmented. The new variants emerge every week, so the emergence of the Pykw virus has been expected. This version does not deviate much from its ancestors:

A full Pykw ransom note contains the following information:

The Pykw decryptor is not a cheap piece of software. Criminals evaluate it for $780 and, most probably, there are many people who agree to pay this amount in exchange for unlocking important Microsoft Office documents, file archives, photos, and other data, especially when no backups are available.

Nevertheless, it is not advisable to pay the ransom. Experts from the NoVirus.uk team recommends people make a copy of the locked files using a USB stick, hard drive, or cloud storage and then remove Pykw ransomware from the system.

It's important to stress the fact that Djvu ransomware family members are programmed to download AZORult trojan as a secondary payload. The latter may install spying software and start recording keystrokes, take screenshots, and perform other activities to get access to the victim's bank accounts.

In general, the sooner you perform Pykw removal, the chance of getting a banking trojan and experience further losses will decrease. Please note that paying the redemption for criminals is not a guarantee that a fully functional decryptor will reach you.

These methods can help you to retrieve separate files. However, do not initiate any file recovery steps before ransomware removal.

• It is distributed via malicious spam email attachments and software cracks in particular;
• Upon infiltration, it stops many Windows system processes from running, including anti-virus;
• It launched an AES or another cipher that scans the machine for compatible file styles (over 200 extensions) and locks all of them using .pykw extension;
• Victims get the _readme.txt note, which contains instructions on how to pay the ransom (only Bitcoins are accepted);
• Those who pay the ransom within 72 hours can use a discount, i.e. the ransom size is double dropped to $480 instead of $790;

From our report of Jun 2020 · not reviewed since

Ransomware authors disguise malicious files in popular places, such as P2P networks or shady download sites

Cybersecurity experts stress the fact that the Internet is not a safe place where every content could be trusted.

Statistically, dangerous viruses, such as ransomware, trojans, spyware, etc. are typically distributed by means of spam email. Crooks append malicious payload to word documents, zip files, pdf files, etc. and represent them as original content. Usually, these attachments command people to enable Macros to read the content. That's a catch because Macros enabling means the launch of ransomware payload.

In addition to spam, file-encrypting viruses are often hidden under hyperlinks and adverts positioned on unprotected networks, such as P2P, online gaming, streaming, gambling, pornographic sites, etc. Thus, clicking on any content presented on suchlike websites poses a risk of getting your files locked.

Another popular ransomware distribution way is pirated files, such as software cracks, game cheats, keygens, license keys, and similar. According to experts and victims' reports on Reddit , Djvu ransomware family members are most frequently distributed this way. Thus, restrain from any illegal online content to protect yourself from cybercrime.

From our report of Jun 2020 · not reviewed since

Do not postpone Pykw ransomware removal and try to restore .pykw files

Every ransomware victim wonders whether to pay the ransom or not.

Although most probably criminals have a fully functional Pykw decryptor, no one can guarantee that upon paying the ransom you will get the key. There's a huge risk that you will be left with empty pockets and permanently locked files.

Do not try to eliminate ransomware manually because it's not possible. This type of virus enters the machine in packages that consist of tens of malicious processes.

Some of them are responsible for stopping Windows processes, the others for rooting into Windows registries, and the others for performing malicious tasks. All these processes can be stopped by rebooting the machine into Safe Mode with Networking and running a scan with , , and similar anti-virus tools.

After a complete Pykw ransomware removal, the Windows system needs a recovery. Corrupted system files, deleted Windows registries, and altered startup processes can lead to errors, BSODs, and slowdowns. Thus, it's advisable to optimize the system using optimization utility.

[GI=method-1]Safe Mode disables malicious processes run by Pykw ransomware. Therefore, if you cannot run an anti-virus program while in normal Windows mode, follow these steps:

[GI=method-2]If Safe Mode did not solve the problem, you can try to remove the ransomware using the System Restore feature

The instructions provided above explain how to remove Pykw ransomware virus from the system. However, virus removal does not mean the recovery of locked files. Thus, we'll provide a couple of methods that can help you to decrypt infected files.

Windows Previous Versions - an in-built Windows OS feature that might help

Windows Previous Versions is a Windows function, which can help to recover your files to the state prior to the ransomware attack. However, this function will work only if you have had the Previous Version feature enabled.

Shadow Explorer can help

Experts claim that Djvu versions are programmed to run a command via an elevated PowerShell to delete all Shadow Volume Copies. However, each variant of this family is slightly different, so you can try to retrieve the files using Shadow Volume Copies.

No decryptor available