Severity scale:  

Remove Pywdu ransomware (Virus Removal Instructions) - Bonus: Decryption Steps

removal by Julie Splinters - - | Type: Ransomware

Pywdu is a newly released member of the gradually expanding Snatch ransomware family

Pywdu files

Pywdu ransomware is malware, which manifested at the end of June 2020. According to cybersecurity researchers, it belongs to the Snatch ransomware family, which has initially emerged back in 2018 and reproduced several deadly dangerous versions, including .FileSlack, .jupstb, .EGMWV, and others. 

The Pywdu ransomware uses targeted spam email campaigns with an intention to attack corporations in particular, though it can end up on home users' PCs as well. Upon infiltration, it uses the AES encryption[1] algorithm to lock data on the targeted PC, which subsequently gets the .pywdu file extension (e.g. 

The attackers drop a ransom note RESTORE_PYWDU_DATA.txt on the desktop and demand victims to contact them via for further instructions. To prove gain victim's trust, crooks claim to restore three files for free, while the rest of the data will be recovered after paying the ransom. Unfortunately, the size of the redemption is not specified, though experts presume that the Pywdu virus developers set up the price depending on how many files have been locked.

Name Pywdu
Class Ransomware / file-locking virus
Family Snatch ransomware
File extension The virus locks files by appending the .pywdu extension
Ransom note RESTORE_PYWDU_DATA.txt
Encryption model Based on its ancestors, the ransomware is likely to render AES-256 encryption algorithm
Distribution The main dissemination technique – targeted spam email messages. However, it can also be distributed via software cracks, keygens, and unprotected RPDs
Decryption Experts haven't yet developed a functional Pywdu decryptor. Therefore, you should either pay the ransom (not recommended), use backups or try alternative data recovery methods, such as Volume Shadow Copies
Ransomware removal The only way to eliminate the package of the malicious files that comprise the Pywdu file virus is to use a professional anti-virus
This ransomware is capable of stopping important Windows processes, altering boot sequence, and creating malicious Windows registries. These changes are not restored during the virus removal. Thus, try to repait system damage with ReimageIntego tool

There's no precise information on how Pywdu ransomware spreads. However, based on the previous variants of this ransomware and ransomware practice, in general, the following means are most likely to be used:

  • Targeted spam emails (contain malicious attachment or hyperlink);
  • Exploits;
  • Pirated software, keygens, cracks;
  • Fake software updates (mimicking Windows software updates, Flash Player updates, etc.);
  • Backdoors (can be downloaded as a secondary payload via Trojans), etc.

Upon the installation, the Pywdu virus stops several Windows processes, injects malicious files in the list of startup programs, and starts running malicious entries, the most active of which is dttcodexgigas.029ff83e481b8c870b58b1e4d9c52cb8ba60954e[2]. This particular processes initiates the following commands via an elevated PowerShell:

  • vssadmin delete shadows /all /quiet
  • sc queryex type= service

It means that the .pywdu file virus disabled Volume Shadow Copies, thus preventing the user from retrieving the locked files without paying the ransom (unless the victim has backups). After all malicious commands are executed, the virus runs a cipher to locked all personal data obtained on the infected machine. According to experts, the ransomware can encrypt the following file types:

.7z, .rar, .m4a, .wma, .avi, .wmv, .csv, .d3dbsp, .sc2save, .sie, .sum, .ibank, .t13, .t12, .qdf, .gdb, .tax, .pkpass, .bc6, .bc7, .bkp, .qic, .bkf, .sidn, .sidd, .mddata, .itl, .itdb, .icxs, .hvpl, .hplg, .hkdb, .mdbackup, .syncdb, .gho, .cas, .svg, .map, .wmo, .itm, .sb, .fos, .mcgame, .vdf, .ztmp, .sis, .sid, .ncf, .menu, .layout, .dmp, .blob, .esm,. 001, .vtf, .dazip, .fpk, .mlx, .kf, .iwd, .vpk, .tor, .psk, .rim, .w3x, .fsh, .ntl, .arch00, .lvl, .snx, .cfr, .ff, .vpp_pc, .lrf, .m2, .mcmeta, .vfs0, .mpqge, .kdb, .db0, .DayZProfile, .rofl, .hkx, .bar, .upk, .das, .iwi, .litemod, .asset, .forge, .ltx, .bsa, .apk, .re4, .sav, .lbf, .slm, .bik, .epk, .rgss3a, .pak, .big, .unity3d, .wotreplay, .xxx, .desc, .py, .m3u, .flv, .js, .css, .rb, .png, .jpeg, .txt, .p7c;
.p7b, .p12, .pfx, .pem, .crt, .cer, .der, .x3f, .srw, .pef, .ptx, .r3d, .rw2, .rwl, .raw, .raf, .orf, .nrw, .mrwref, .mef, .erf, .kdc, .dcr, .cr2, .crw, .bay, .sr2, .srf, .arw, .3fr, .dng, .jpe, .jpg, .cdr, .indd, .ai, .eps, .pdf, .pdd;
.psd, .dbfv, .mdf, .wb2, .rtf, .wpd, .dxg, .xf, .dwg, .pst, .accdb, .mdb, .pptm, .pptx, .ppt, .xlk, .xlsb, .xlsm;
.xlsx, .xls, .wps, .docm, .docx, .doc, .odb, .odc, .odm, .odp, .ods, .odt; (the list is not finite)

Upon file encryption, the victim can no longer access personal files and is blackmailed to purchase a decryption key to unlock .pywdu files. To inform the victim about the attack and awaited response, criminals leave a ransom note RESTORE_PYWDU_DATA.txt on the desktop, which shortly explains what has happened and demands to email them via

Hello! Your all your files are encrypted and only I can decrypt them.
my mail is
Write me if you want to return your files – I can do it very quickly!

Do not rename encrypted files. You may have permanent data loss.
You can be a victim of fraud

To prove that I can recover your files, I am ready to decrypt any three files for free (except databases, Excel and backups)

This will allow us to see all the history of the census in
one place and respond quickly to you.

hurry up!

Those who have received the above-shown ransom note are strongly recommended not to lose once's minds. The ransomware is dangerous and can cost permanent file loss. However, we strongly recommend weighing all pros and cons before paying. Think twice whether the data that has been locked is worth hundreds of dollars and an affair with cybercriminals. 

Pywdu ransomwarePywdu ransomware is a dangerous cyber infection that encrypts files and demands its victims to make the payment for a decryption software

At best, you should immediately copy the encrypted files into an alternative data storage and remove Pywdu ransomware virus from the machine. For this purpose, you should restart the system into Safe Mode (the virus may block the processes of anti-virus programs) and run a robust anti-virus program. 

Pywdu virus removal will not recover the encrypted data, as well as not recover the settings of the Windows OS. Therefore, you should try alternative data recovery methods (listed at the end of this article) and optimize the system with ReimageIntego repair tool. 

Ransomware is usually distributed via spam emails and pirated software

Ransomware is a type of virus that tops the charts of the most dangerous cyber infections. If it gets installed, the victim is endangered to lose personal files, money, or both. Therefore, experts keep warning Internet users about the most common ransomware distribution techniques to help people stay safe. 

Unfortunately, criminals are too inventive and sophisticated to find out various means tricking people into accidentally running malicious files that carry ransomware. The prevailing technique, and still most successful, is malicious attachments appended to spam email messages.

Pywdu file virus distributionPywdu virus is usually spread via malicious spam email attachments

Apart from malspam, ransomware can be activated via software cracks, keygens, and other pirated content. Therefore, it's crucial to take precautionary measures to stay away from dangerous content.[3] experts have excluded the basic precautionary measures that each user should mind:

  • Download and use a robust anti-virus solution. At best, use the whole package of security software to ensure the highest protection level;
  • Regularly install software updates, OS updates, and patch vulnerabilities 
  • Investigate every email before opening its attachments. Even if you received a message asking to confirm the order or check something, it doesn't mean that you can open the .doc, .pdf, .htm, or another type of attachment. Double-check the sender, look for grammar/type mistakes, and other hooks showing the email to be spam. You can also scan the attachment with an anti-virus tool if it has scan to e-mail function
  • Use a strong password and VPN when using Remote Desktop Protocol;
  • Stay away from dangerous websites (porn, gambling, P2P, torrent, etc.)

Delete Pywdu ransomware before trying to recover locked data 

Indeed, finding all files encrypted by the .pywdu file virus is shocking and most of the users consider paying the ransom. Probably, paying the ransom seems to be the sole solution for those who keep important work files and archives on the system, family photos, and other documents and do not regularly make backups. 

If you have backups on external hard drive or cloud, you have nothing to worry about. Remove Pywdu virus immediately using SpyHunter 5Combo Cleaner, Malwarebytes or alternative security tool, recovery the system with ReimageIntego, and then recover .pywdu files from backups. If, however, you have no backups, we do not recommend paying criminals for their delinquent activities. Instead, eliminate the ransomware and try to recover data using alternative methods. 

Pywdu virus detectionPywdu ransomware can be quarantined and removed by most of the professional AV programs

Unfortunately, Pywdu removal won't recover encrypted files. However, it is expected that experts will soon find a flaw in the ransomware file encryption model and generate a fully functional decryption tool. Therefore, we recommend copying locked files into the external storage, giving a try for third-party data recovery tools, and, in case of no luck, wait for a decryptor to be launched. 

do it now!
Reimage Happiness
Intego Happiness
Compatible with Microsoft Windows Supported versions Compatible with OS X Supported versions
What to do if failed?
If you failed to remove virus damage using Reimage Intego, submit a question to our support team and provide as much details as possible.
Reimage Intego has a free limited scanner. Reimage Intego offers more through scan when you purchase its full version. When free scanner detects issues, you can fix them using free manual repairs or you can decide to purchase the full version in order to fix them automatically.
Alternative Software
Different software has a different purpose. If you didn’t succeed in fixing corrupted files with Reimage, try running SpyHunter 5.
Alternative Software
Different software has a different purpose. If you didn’t succeed in fixing corrupted files with Intego, try running Combo Cleaner.

To remove Pywdu virus, follow these steps:

Remove Pywdu using Safe Mode with Networking

Since Pywdu virus may block security software, restart Windows into Safe Mode to run a scan.

  • Step 1: Reboot your computer to Safe Mode with Networking

    Windows 7 / Vista / XP
    1. Click Start Shutdown Restart OK.
    2. When your computer becomes active, start pressing F8 multiple times until you see the Advanced Boot Options window.
    3. Select Safe Mode with Networking from the list Select 'Safe Mode with Networking'

    Windows 10 / Windows 8
    1. Press the Power button at the Windows login screen. Now press and hold Shift, which is on your keyboard, and click Restart..
    2. Now select Troubleshoot Advanced options Startup Settings and finally press Restart.
    3. Once your computer becomes active, select Enable Safe Mode with Networking in Startup Settings window. Select 'Enable Safe Mode with Networking'
  • Step 2: Remove Pywdu

    Log in to your infected account and start the browser. Download ReimageIntego or other legitimate anti-spyware program. Update it before a full system scan and remove malicious files that belong to your ransomware and complete Pywdu removal.

If your ransomware is blocking Safe Mode with Networking, try further method.

Remove Pywdu using System Restore

If Safe Mode failed to work, try the in-built System Restore feature.

  • Step 1: Reboot your computer to Safe Mode with Command Prompt

    Windows 7 / Vista / XP
    1. Click Start Shutdown Restart OK.
    2. When your computer becomes active, start pressing F8 multiple times until you see the Advanced Boot Options window.
    3. Select Command Prompt from the list Select 'Safe Mode with Command Prompt'

    Windows 10 / Windows 8
    1. Press the Power button at the Windows login screen. Now press and hold Shift, which is on your keyboard, and click Restart..
    2. Now select Troubleshoot Advanced options Startup Settings and finally press Restart.
    3. Once your computer becomes active, select Enable Safe Mode with Command Prompt in Startup Settings window. Select 'Enable Safe Mode with Command Prompt'
  • Step 2: Restore your system files and settings
    1. Once the Command Prompt window shows up, enter cd restore and click Enter. Enter 'cd restore' without quotes and press 'Enter'
    2. Now type rstrui.exe and press Enter again.. Enter 'rstrui.exe' without quotes and press 'Enter'
    3. When a new window shows up, click Next and select your restore point that is prior the infiltration of Pywdu. After doing that, click Next. When 'System Restore' window shows up, select 'Next' Select your restore point and click 'Next'
    4. Now click Yes to start system restore. Click 'Yes' and start system restore
    Once you restore your system to a previous date, download and scan your computer with ReimageIntego and make sure that Pywdu removal is performed successfully.

Bonus: Recover your data

Guide which is presented above is supposed to help you remove Pywdu from your computer. To recover your encrypted files, we recommend using a detailed guide prepared by security experts.

There's no functional Pywdu decryptor. Nevertheless, experts recommend trying third-party software for data recovery. 

If your files are encrypted by Pywdu, you can use several methods to restore them:

Use Data Recovery Pro tool

Data Recovery Pro is a free tool for data recovery. It is usually used after system crash, though its powerful recovery engine may help to unlock at least some of the locked files.

  • Download Data Recovery Pro;
  • Follow the steps of Data Recovery Setup and install the program on your computer;
  • Launch it and scan your computer for files encrypted by Pywdu ransomware;
  • Restore them.

Windows Previous Versions Feature might be of use

If you enabled System Restore prior to the attack, Windows Previous Versions Feature might work when trying to restore .pywdu files. 

  • Find an encrypted file you need to restore and right-click on it;
  • Select “Properties” and go to “Previous versions” tab;
  • Here, check each of available copies of the file in “Folder versions”. You should select the version you want to recover and click “Restore”.

Shadow explorer won't work

As we have pointed out, this ransomware enabled a file, which runs PowerShell commands to delete Volume Shadow copies. Therefore, this method won't work.

  • Download Shadow Explorer (;
  • Follow a Shadow Explorer Setup Wizard and install this application on your computer;
  • Launch the program and go through the drop down menu on the top left corner to select the disk of your encrypted data. Check what folders are there;
  • Right-click on the folder you want to restore and select “Export”. You can also select where you want it to be stored.

Pywdu decryptor is in the development phase.

Finally, you should always think about the protection of crypto-ransomwares. In order to protect your computer from Pywdu and other ransomwares, use a reputable anti-spyware, such as ReimageIntego, SpyHunter 5Combo Cleaner or Malwarebytes

Stream videos without limitations, no matter where you are

There are multiple parties that could find out almost anything about you by checking your online activity. While this is highly unlikely, advertisers and tech companies are constantly tracking you online. The first step to privacy should be a secure browser that focuses on tracker reduction to a minimum.

Even if you employ a secure browser, you will not be able to access websites that are restricted due to local government laws or other reasons. In other words, you may not be able to stream Disney+ or US-based Netflix in some countries. To bypass these restrictions, you can employ a powerful Private Internet Access VPN, which provides dedicated servers for torrenting and streaming, not slowing you down in the process.

Data backups are important – recover your lost files

Ransomware is one of the biggest threats to personal data. Once it is executed on a machine, it launches a sophisticated encryption algorithm that locks all your files, although it does not destroy them. The most common misconception is that anti-malware software can return files to their previous states. This is not true, however, and data remains locked after the malicious payload is deleted.

While regular data backups are the only secure method to recover your files after a ransomware attack, tools such as Data Recovery Pro can also be effective and restore at least some of your lost data.

About the author
Julie Splinters
Julie Splinters - Malware removal specialist

If this free removal guide helped you and you are satisfied with our service, please consider making a donation to keep this service alive. Even a smallest amount will be appreciated.

Contact Julie Splinters
About the company Esolutions


Your opinion regarding Pywdu ransomware