Severity scale:  

Whoopsie ransomware. How to remove? (Uninstall guide)

removal by Julie Splinters - - | Type: Ransomware

Whoopsie ransomware is a file-encrypting virus developed by German-speaking hackers

Whoopsie ransomware image
Whoopsie is a ransomware which compromises data on the computer and asks to pay €50 as a ransom.

Whoopsie is a ransomware-type cyber threat which is designed to encrypt data using AES cryptography[1]. At this point, the user is no longer able to use the encoded information with .whoopsie extension, unless it is decrypted with a unique key. Criminals demand to pay €50 in Bitcoins for the decryption software. According to the experts, this infection is created by an attacker located in Germany.

Name Whoopsie
Type Ransomware
Danger level High
Cryptography Advanced Encryption Standard (AES)
File extension .whoopsie
Amount of the ransom €50 in BTC
Decryptable No. But you can find alternative ways how to recover data at the end of this article.
Removal The safest way to uninstall Whoopsie ransomware is with Reimage

Once Whoopsie ransomware infects the system, it starts encrypting the most widely used files on the system by employing AES algorithms. Afterward, the encoded files are appended with .whoopsie extension and become unusable. The victim merely receives a pop-up window named as Whoopsie which serves as the ransom note.

People are informed about Whoopsie virus infection and the following information:

Do NOT close this Window! (otherwise your Files are gone for even and cant be recovered!)

Your files has been encrypted with Advanced Encryption Standard (AES) and can't be decrypted without a specific key (in this case a ransom generated String)

How to get the key?
Its easier than it seams! Just pay a small fee of 50€ in BTC to {paymentadress} and you will get your decryption key

Unfortunately, there are no guarantees that you will receive Whoopsie ransomware decryptor after paying the so-called small fee. In fact, despite how insignificant the amount of the ransom might seem, attackers can force you to spend more and more after you contact them[2]

Instead of agreeing to the rules of the criminals, we advise you remove Whoopsie ransomware after the infection. You should get help from a professional security tool such as Reimage. Keep in mind that you shouldn't try to eliminate this dangerous cyber threat on your own or you might damage your PC even more.

After Whoopsie virus removal, you will be able to try alternative ways to get back the access to your data. All of them are presented at the end of this article. Although, they are effective only once the ransomware is uninstalled from the infected system.

Distribution: spam emails, peer-to-peer (P2P) networks, and malvertising

Since ransomware-type infections are almost the most dangerous ones, criminals are highly interested in distributing them worldwide. For that, they employ not one, but multiple spread techniques to increase the infection rates of Whoopsie ransomware and similar threats. According to the experts from UK[3], today the most popular distribution method is malicious email attachments.

This method is often recognized as malspam campaigns which are designed to distribute legitimate-looking emails with an infected attachment inside. Once the user clicks on the file, it drops the payload of the ransomware and infects the system. Thus, people should NEVER open letters from suspicious users or companies.

Furthermore, Whoopsie ransomware can enter the system from the shady peer-to-peer (P2P) file-sharing site or malicious ads on websites. Our experts recommend you to download programs only from verified authors and distributors. Additionally, monitor your online activity and refrain from clicking on commercial content to avoid Whoopsie ransomware.

Whoopsie ransomware removal explained

The only way to remove Whoopsie ransomware without causing more damage to the system is by using a robust and reliable antivirus. You can choose to pick Reimage, Malwarebytes, or Plumbytes Anti-MalwareNorton Internet Security and run a full system scan for the elimination.

After Whoopsie ransomware removal, read the guidelines below attentively and learn how to recover files without paying the ransom or using backup copies on the cloud. 

We might be affiliated with any product we recommend on the site. Full disclosure in our Agreement of Use. By Downloading any provided Anti-spyware software you agree to our privacy policy and agreement of use.
do it now!
Reimage (remover) Happiness
Reimage (remover) Happiness
Compatible with Microsoft Windows Supported versions Compatible with OS X Supported versions
What to do if failed?
If you failed to remove virus damage using Reimage, submit a question to our support team and provide as much details as possible.
Reimage is recommended to remove virus damage. Free scanner allows you to check whether your PC is infected or not. If you need to remove malware, you have to purchase the licensed version of Reimage malware removal tool.
More information about this program can be found in Reimage review.

If you decided to select another anti-spyware, uninstall Reimage from your computer.
Press mentions on Reimage
Alternate Software
Alternate Software

To remove Whoopsie virus, follow these steps:

Remove Whoopsie using Safe Mode with Networking

First step. Reboot the computer to Safe Mode as shown below.

  • Step 1: Reboot your computer to Safe Mode with Networking

    Windows 7 / Vista / XP
    1. Click Start Shutdown Restart OK.
    2. When your computer becomes active, start pressing F8 multiple times until you see the Advanced Boot Options window.
    3. Select Safe Mode with Networking from the list Select 'Safe Mode with Networking'

    Windows 10 / Windows 8
    1. Press the Power button at the Windows login screen. Now press and hold Shift, which is on your keyboard, and click Restart..
    2. Now select Troubleshoot Advanced options Startup Settings and finally press Restart.
    3. Once your computer becomes active, select Enable Safe Mode with Networking in Startup Settings window. Select 'Enable Safe Mode with Networking'
  • Step 2: Remove Whoopsie

    Log in to your infected account and start the browser. Download Reimage or other legitimate anti-spyware program. Update it before a full system scan and remove malicious files that belong to your ransomware and complete Whoopsie removal.

If your ransomware is blocking Safe Mode with Networking, try further method.

Remove Whoopsie using System Restore

  • Step 1: Reboot your computer to Safe Mode with Command Prompt

    Windows 7 / Vista / XP
    1. Click Start Shutdown Restart OK.
    2. When your computer becomes active, start pressing F8 multiple times until you see the Advanced Boot Options window.
    3. Select Command Prompt from the list Select 'Safe Mode with Command Prompt'

    Windows 10 / Windows 8
    1. Press the Power button at the Windows login screen. Now press and hold Shift, which is on your keyboard, and click Restart..
    2. Now select Troubleshoot Advanced options Startup Settings and finally press Restart.
    3. Once your computer becomes active, select Enable Safe Mode with Command Prompt in Startup Settings window. Select 'Enable Safe Mode with Command Prompt'
  • Step 2: Restore your system files and settings
    1. Once the Command Prompt window shows up, enter cd restore and click Enter. Enter 'cd restore' without quotes and press 'Enter'
    2. Now type rstrui.exe and press Enter again.. Enter 'rstrui.exe' without quotes and press 'Enter'
    3. When a new window shows up, click Next and select your restore point that is prior the infiltration of Whoopsie. After doing that, click Next. When 'System Restore' window shows up, select 'Next' Select your restore point and click 'Next'
    4. Now click Yes to start system restore. Click 'Yes' and start system restore
    Once you restore your system to a previous date, download and scan your computer with Reimage and make sure that Whoopsie removal is performed successfully.

Bonus: Recover your data

Guide which is presented above is supposed to help you remove Whoopsie from your computer. To recover your encrypted files, we recommend using a detailed guide prepared by security experts.

If your files are encrypted by Whoopsie, you can use several methods to restore them:

Get Data Recovery Pro

Experts highly recommend trying this professional software after ransomware attack. Despite the fact that it was primarily designed to help users after the system crash, it might be useful in data recovery as well.

  • Download Data Recovery Pro;
  • Follow the steps of Data Recovery Setup and install the program on your computer;
  • Launch it and scan your computer for files encrypted by Whoopsie ransomware;
  • Restore them.

Use Windows Previous Versions Feature

If you have previously enabled System Restore function, you can travel back in time and retrieve files before they were encrypted.

  • Find an encrypted file you need to restore and right-click on it;
  • Select “Properties” and go to “Previous versions” tab;
  • Here, check each of available copies of the file in “Folder versions”. You should select the version you want to recover and click “Restore”.

Employ ShadowExplorer

This tool is only effective if the ransomware hasn't deleted or compromised Shadow Volume Copies on your computer.

  • Download Shadow Explorer (;
  • Follow a Shadow Explorer Setup Wizard and install this application on your computer;
  • Launch the program and go through the drop down menu on the top left corner to select the disk of your encrypted data. Check what folders are there;
  • Right-click on the folder you want to restore and select “Export”. You can also select where you want it to be stored.

Whoopsie ransomware decryptor is still under-development.

About the author

Julie Splinters
Julie Splinters - Malware removal specialist

If this free removal guide helped you and you are satisfied with our service, please consider making a donation to keep this service alive. Even a smallest amount will be appreciated.

Contact Julie Splinters
About the company Esolutions