Adww Virus

7-day Free Trial w/Credit card, no charge upfront or if you cancel up to 2 days before expiration; Subscription price varies per region w/ auto renewal unless you timely cancel; notification before you are billed; 30-day money-back guarantee; Read full terms and more information about free remover.

*Adww is a variant of Stop/DJVU. Source of claim SH can remove it.


Adww is a cryptovirus from the Ransomware type that is designed to encrypt user data and extort money through blackmail. Typically, Adww will demand a ransom payment from its victims in order to decrypt their files.

Adww 1024x607
The Adww ransomware will leave a _readme.txt file with instructions

Did you land on this page because of a recent infection with Adww? If yes, then you have to stick around and read the information below. Unfortunately, Ransomware is one of the most problematic categories of malware. The stealth and the incredibly sophisticated algorithms used by these viruses has resulted in an unprecedented growth of thousands of new samples. And while this growth is very disturbing and is the primary cause of concern for many security experts, it is not that difficult to prevent such infections and their potential damage if you take the needed precautions. In the following article, we’re going to cover this and we will also provide you with a removal guide that will show you the steps needed to remove infections like Adww, Ofoq or Ofww from your system. This same guide contains instructions on how to potentially restore your encrypted files from backups hidden in your system. Be warned, though, that due to the complexity of the file-encryption process, we cannot guarantee the effectiveness of the file restoration steps.

The Adww virus

The Adww virus is a Ransomware creation of a group of cybercriminals. The criminals use the Adww virus to extort money from the victims by encrypting their digital information.

This particular type of virus has become so popular among hackers mainly because of its profitability. Many victims keep sending money to the crooks and strictly fulfill their ransom demands with the hopes that the hackers will send them the decryption key for the sealed files.

And it doesn’t help that the users get threatened on their screens by ransom notes which intimidate them by claiming that all encrypted data will be lost forever if they don’t pay. Of course, we realize that the hackers literally block access to files that are very important to you, but at the same time, there are a number of reasons not to pay them.

The Adww file decryption

The Adww file decryption is possible after the application of a special decryption key. The crooks who hold the Adww file decryption key, however, will demand a ransom in bitcoins in order to send it to you.

Adww Virus 1024x613
The Adww virus will encrypt your files

By paying the ransom, for example, you are going to directly sponsor the hackers’ blackmail scheme. This way, they will get additional resources and motivation to attack you and other web users again, thus repeating the entire cycle. Sadly, that’s hardly what anyone thinks about when paying the ransom. At the same time, sending large amounts of money to anonymous cyber criminals with the expectation that they will give you something in exchange (a decryption key for your files, in your case) is very risky. It commonly happens that people never get anything in return for their money and the cyber criminals just disappear without a trace. That’s why, instead of surrendering to the demands in the ransom note, we highly recommend that the victims of Ransomware explore other solutions, such as the removal guide below. The instructions there can help them detect and remove Adww while the file-recovery suggestions section may give them some ideas on where and how they may be able to get some of the encrypted files back.


Detection Tool

*Adww is a variant of Stop/DJVU. Source of claim SH can remove it.

Remove Adww Ransomware


It is highly advisable that you Bookmark the page with these instructions so you can quickly get back to them when you need them.

Also, it is recommended that you reboot your PC in Safe Mode. This mode will run only the most essential system processes and will make it easier for you to detect and remove the ransomware.



*Adww is a variant of Stop/DJVU. Source of claim SH can remove it.

Now, let’s start with the actual removal process. The first thing is to open your Windows Task Manager. This can be done by using the 

CTRL + SHIFT + ESC key combination. Once you see the Task Manager window click on the Processes Tab and carefully search for Adww-related processes in the list. If a given process uses too much CPU or Memory and behaves in an unusual way or you can’t relate it to a program that you trust, right-click on it and then select the “Open File Location” option.


When you get to the file location of the process in question, scan the files stored there with the free online virus scanner that is available here:

Each file will be scanned with up to 64 antivirus programs to ensure maximum accuracy
This scanner is free and will always remain free for our website's users.
This file is not matched with any known malware in the database. You can either do a full real-time scan of the file or skip it to upload a new file. Doing a full scan with 64 antivirus programs can take up to 3-4 minutes per file.
Drag and Drop File Here To Scan
Drag and Drop File Here To Scan
Analyzing 0 s
Each file will be scanned with up to 64 antivirus programs to ensure maximum accuracy
    This scanner is based on VirusTotal's API. By submitting data to it, you agree to their Terms of Service and Privacy Policy, and to the sharing of your sample submission with the security community. Please do not submit files with personal information if you do not want them to be shared.

    Wait a couple of seconds for the scan to complete and if the results show malicious content, end the questionable processes from the Processes tab and delete its folders from their file location. 



    In this step, we will show you what to do if you have a suspicion that your computer is hacked. For that, press the Start and R keys from the keyboard to open a Run window on your screen. Then, in that window copy the following:

    notepad %windir%/system32/Drivers/etc/hosts

    Click OK for the command to run. 

    A file named Hosts will open on the screen. Scroll the file and find where it is written Localhost.

    If your computer is hacked, different questionable IPs will be shown under Localhost. 

    hosts_opt (1)


    Attention! In order to confirm or rule out this possibility, please leave us a comment under this post if you detect any suspicious IPs below “Localhost” in your Hosts file.

    Important! Ransomware threats like Adww are known to add some helper components in the Startup section of your computer in order to ensure that they launch in the background as soon as you start the system. If you want to remove the threat, however, these components need to be detected and removed. For that, open the System Configuration app (type msconfig in the Windows search field and press enter) and then select the Startup tab as shown on the image below: 



    Normally, you should see a list of entries related to your system and your trusted apps. Those that have checkmarks on them will start upon system startup. If you detect entries that  “Unknown” Manufacturer or look suspicious, it is best to carefully research them and remove their checkmarks if they turn out to be related to the ransomware or some other threat. 

    Please keep in mind that ransomware like Adww may use fake names and Manufacturers for its entries in order to delude you. Check every process in the startup list and leave the checkmark only for the entries that are legitimate.



    The next place where you have to search for traces of Adww is the Registry. Ransomware threats may make malicious changes to some directories, thus, these changes need to be detected and removed. The best way to do that is to open the Registry Editor app (type Regedit in the windows search field and press Enter) and use the Find function (CTRL and F keyboard key combination) to search for ransomware-related traces. Type the ransomware’s Name in the Find box that pops up in the Registry Editor and then click on the Find Next button. If there are entries that are found with this name, delete them.

    Be careful! Deletions unrelated to Adww can damage your system! Use a professional removal tool if you are not sure which Registry entries should be removed.

    After you remove all ransomware-related entries that are found in the Registry, it is time to manually clean up a few more system locations. Type every single one of the listed items below in the Windows Search Field:

    1. %AppData%
    2. %LocalAppData%
    3. %ProgramData%
    4. %WinDir%
    5. %Temp%

    When you get to each of the listed locations, carefully check for any recently added files. When you open the Temp folder, remove all of its content. If you run into trouble, please, leave us a comment, and we will do our best to help.


    How to Decrypt Adww files

    Victims of ransomware may need to resort to different file-recovery methods depending on the ransomware variant that has infected them. The file-recovery instructions below will only be useful if you know the specific ransomware strain that has locked your files. You can learn that by inspecting the encrypted files for any new file extensions that may have been added.

    New Djvu Ransomware

    STOP Djvu is the most recent variant of the Djvu ransomware family that has been attempting to infect systems worldwide. Typically, after an attack with this threat, the .Adww extension is appended to the end of all files encrypted by this variant of ransomware. The fact that the infection is new means that there are very limited file-recovery options, but this should not discourage you. In the link below, you will find a decryptor tool that may be of use, especially if your files have been encrypted with a known offline key:

    The STOPDjvu executable program can be downloaded by opening the provided URL and clicking the Download button in the upper right corner. To run the file, choose Run as administrator and confirm the action by clicking the Yes button. Don’t skip reading the license agreement and the instructions for use, and after you are done, you may move on to the decryption process. To get started, just hit the Decrypt button. Please note that this decryptor may not be effective if your files have been encrypted with an unknown offline key or an online encryption.

    To have success with the file-recovery, it is very important to first clean your computer of Adww and other malware. You can do this with a good antivirus program or a trusted online virus scanner. Don’t be shy about getting in touch with us in the comments if you have any questions or issues while completing the steps from the guide.


    About the author

    Lidia Howler

    Lidia is a web content creator with years of experience in the cyber-security sector. She helps readers with articles on malware removal and online security. Her strive for simplicity and well-researched information provides users with easy-to-follow It-related tips and step-by-step tutorials.

    Leave a Comment

    We are here to help! Use SpyHunter to remove malware in under 15 minutes.

    Not Your OS? Download for Windows® and Mac®.

    * See Free Trial offer details and alternative Free offer here.

    ** SpyHunter Pro receives additional removal definitions and manual fixes through its HelpDesk in cases where they are needed.

    Spyware Helpdesk 1