Dewd Virus

7-day Free Trial w/Credit card, no charge upfront or if you cancel up to 2 days before expiration; Subscription price varies per region w/ auto renewal unless you timely cancel; notification before you are billed; 30-day money-back guarantee; Read full terms and more information about free remover.

*Dewd is a variant of Stop/DJVU. Source of claim SH can remove it.


Dewd is a Ransomware cryptovirus that can infect your system secretly. If you see a message from Dewd on your screen that tells you some of your files have been encrypted, then you have become a victim of this Ransomware.

The Dewd ransomware will leave a _readme.txt file with instructions

Unfortunately, these types of threats like Jhbg, Jhdd are some of the most terrifying malware representatives that might enter your system. They typically encrypt various types of user data and demand a ransom for the decryption key needed to get back the sealed files. In the next lines, however, you will find detailed instructions on how to remove Dewd, as well as some alternative steps on how to restore your files. Before you make use of them, though, we would like to shed a little more light on what exactly a Ransomware is, so you can better comprehend the processes through which you can remove it, and protect your computer.

The Dewd virus

The Dewd virus is a special type of Ransomware known as a cryptovirus. You will know that you have been infected with the Dewd virus when the malware displays a ransom-demanding note on your screen.

dewd virus
The Dewd virus will encrypt your files

Such types of threats generally spread via spam emails or other spam messages. You may have received a message from some unknown sender with an enclosed file in it, or a link to some website with some sketchy offer. Or, you may have come across some ads or shady web pages. Opening or clicking on any of those transmitters will immediately download Dewd on your PC, and, unfortunately, you won’t even know about it. The Ransomware won’t show any visible symptoms of its presence neither at the time of the contamination nor while encrypting your files. Once it has finished its dirty work, however, it will generate a ransom-demanding message directly on your screen, or inside the folders with encrypted data.

The .Dewd file encryption

The .Dewd file encryption is a stealthy process that takes place in the background of your system. Decrypting the .Dewd file encryption typically requires a special key that is initially in the hands of the hackers.

If you are reading this, it is very likely that you may have already seen the ransom demand placed on your screen. Moreover, you may not even have the money that the hackers require for the ransom. But don’t despair. Instead, consider this – if you pay the crooks, they might give you the decryption key for your files, or they may not. And in the event that they disappear after the ransom payment, you won’t be able to do anything to get the key or your money back.
Not to mention that by sending money to the hackers behind the Ransomware, you will only encourage these dishonest blackmailers to continue to break into more people’s computers, and blackmail them as well.

Therefore, we suggest that you first try to handle this problem with the assistance of the guide below, before you consider the payment of the ransom as an actual option. Our instructions will show you how to remove Dewd from the system, as well as how to potentially save some of your files from backup copies. It won’t cost anything to you to give the alternative steps a try. Besides, you can always have the option to contact the hackers if nothing else works.


Danger LevelHigh (Ransomware is by far the worst threat you can encounter)
Data Recovery ToolNot Available
Detection Tool

*Dewd is a variant of Stop/DJVU. Source of claim SH can remove it.

Remove Dewd Ransomware


The first thing you should do is bookmark these Dewd removal instructions in your browser so that you can quickly access them later. This way, you don’t have to keep searching for the removal guide after every reboot of your system. Next, we recommend that you restart your computer in Safe Mode to ensure that only the most necessary processes and applications are running. After you do that, you are ready to proceed to the instructions in the second step.



*Dewd is a variant of Stop/DJVU. Source of claim SH can remove it.

On your keyboard, press CTRL+SHIFT+ESC to open the Task Manager. By clicking on the Process tab, check your system for processes that aren’t associated with any of your regular programs, as well as those that take up a large portion of your system’s resources for no apparent reason. Select Open File Location from the menu that appears when a suspicious process is right-clicked.


Use the free online virus scanner listed below to check suspicious-looking files for malware.

Each file will be scanned with up to 64 antivirus programs to ensure maximum accuracy
This scanner is free and will always remain free for our website's users.
This file is not matched with any known malware in the database. You can either do a full real-time scan of the file or skip it to upload a new file. Doing a full scan with 64 antivirus programs can take up to 3-4 minutes per file.
Drag and Drop File Here To Scan
Drag and Drop File Here To Scan
Analyzing 0 s
Each file will be scanned with up to 64 antivirus programs to ensure maximum accuracy
    This scanner is based on VirusTotal's API. By submitting data to it, you agree to their Terms of Service and Privacy Policy, and to the sharing of your sample submission with the security community. Please do not submit files with personal information if you do not want them to be shared.

    Remove any potentially harmful files that may have been discovered there. Before deleting any files, though, first right-click the suspicious process and select End Process from the quick menu.


    Use the Windows search bar to search for msconfig, and then press Enter. As soon as you’ve done that, the window for System Configuration will pop up. The Startup tab will allow you to see what apps are currently set to start with your computer. Dewd-related startup items must be disabled by removing their checkmarks from your startup tab.


    The Hosts file on a computer is another location where changes could be made due to a system compromise. That’s why, after you’ve finished configuring System Configuration, open the file and check the “Localhost” section to see if any of the IP addresses listed there are malicious.

    To open the Hosts file, press Win and R at the same time and then paste the following command in the Run box:

    notepad %windir%/system32/Drivers/etc/hosts

    Then press Enter, and if you see any unusual IP addresses in the file under Localhost, please let us know right away by posting a comment below this guide. Unknown IP addresses will be investigated to determine whether or not they pose a security risk.

    hosts_opt (1)

    *Dewd is a variant of Stop/DJVU. Source of claim SH can remove it.

    It is becoming more common for malware authors to insert harmful registry entries in the system in an attempt to avoid detection by anti-malware programs. You can check your registry for malicious files using the Registry Editor. Simply enter “Regedit” in the Windows search bar and press the Enter key to get started. Next, press CTRL and F, type the name of the ransomware in the Find box and use the Find Next button to look for any files that might be linked to the virus.

    To get rid of any traces of the ransomware, delete the entries that are found. Once the first results have been removed, the registry can be searched again for additional files with the same name.

    Attention! Non-ransomware files may be accidentally deleted while you are clearing the registry, which may cause damage to your computer. Therefore, using a trusted anti-virus program is the better option because it safely removes potentially dangerous software and registry entries from your PC, without deleting legitimate files.

    The following locations should also be checked manually for any suspicious entries. To do that, go to the Windows search bar, type each one of the following entries, and press Enter to open it: 

    1. %AppData%
    2. %LocalAppData%
    3. %ProgramData%
    4. %WinDir%
    5. %Temp%

    Make sure to get rid of any suspicious files you find in these locations. Also, its a good idea to remove all temporary files from your Temp directory by holding CTRL and A and pressing the Del key after that.


    How to Decrypt Dewd files

    It’s up to those who have had the ransomware removed to deal with the challenge of recovering their encrypted data. A ransomware infection’s method of decryption will vary based on the variant of ransomware on your computer. Ransomware variants can be easily identified by looking at the file extensions that are added to the encrypted data.

    You should run a scan with a professional malware removal program (like the one on this page) on the infected computer before trying to recover any files. As long as the virus and ransomware scans come back clear, you can then proceed to try out various file recovery methods.

    New Djvu Ransomware

    An entirely new Djvu ransomware variant, called STOP Djvu, has been discovered by security researchers. The .Dewd suffix added to the encrypted files distinguishes this new variant from other types of malware. It is possible to decrypt files encrypted by this threat using an offline decryptor, such as the one available at the link below:

    After downloading the STOPDjvu.exe file from the link above, select “Run as Administrator” to open it. Next, read the license agreement and any brief instructions that come with it. Please be aware that files encrypted with unknown offline keys or online encryption cannot be decrypted using this tool.

    If you find yourself in trouble, please remember that ransomware can be quickly and easily removed using the anti-virus software on this page. A free online virus scanner can also be used to scan any suspicious files that you find on your computer.


    About the author


    Lidia Howler

    Lidia is a web content creator with years of experience in the cyber-security sector. She helps readers with articles on malware removal and online security. Her strive for simplicity and well-researched information provides users with easy-to-follow It-related tips and step-by-step tutorials.

    Leave a Comment

    We are here to help! Use SpyHunter to remove malware in under 15 minutes.

    Not Your OS? Download for Windows® and Mac®.

    * See Free Trial offer details and alternative Free offer here.

    ** SpyHunter Pro receives additional removal definitions and manual fixes through its HelpDesk in cases where they are needed.

    Spyware Helpdesk 1