Payms Ransomware

Payms Ransomware is a threat that users usually download themselves. Although ransomware infections, in some cases, are silently downloaded by Trojans, and they can silently slither into your operating system via software bundles, users usually execute ransomware themselves. According to our research, most infections of this kind are spread via misleading spam email attachments. Even though you might be introduced to a file that looks like a PDF document or a simple photo, in reality, this file is a malicious executable that launches an infection once opened. If you are tricked into opening this corrupted spam email attachment, the malicious ransomware proceeds to encrypt your personal files. Basically, the threat takes your personal files hostage as leverage to demand a huge ransom payment. Learn more about this ransom, as well as the removal of Payms Ransomware, by reading the report.

According to our malware research, Payms Ransomware is a variant of the infamous Jigsaw Ransomware. This infection is available via dark web markets, and anyone can exploit it to create their own threats. CryptoHitman Ransomware is another well-known version of this dangerous infection. Although the source code might be the same, this infection is unique in some ways. It was found that this infection creates a text file that is represented in both English and Spanish, which means that this threat has the potential to be spread in different countries all across the world. The text file of the malicious ransomware is created after the encryption of your files is completed, and it might be the first sign of its existence. The notification informs that you are required to pay a ransom of $150 within 24 hours – after which the ransom increases – to get the files decrypted. A link to the so-called chat page is added as well, but our research has revealed that, at the moment, this link routes to a third-party page that does not help to contact cyber criminals. The notification also informs that the payment needs to be paid using Bitcoin, a virtual currency that cyber criminals use because it is impossible to trace the transaction.

Once the malicious Payms Ransomware encrypts your personal files using the AES algorithm, it adds unique extensions to them. Our research has revealed that different extensions could be utilized by this threat, and a few of them include ".payms", ".paymst", and ".pays". It is possible to delete these extensions; however, this would not change the file encryption status. Deleting Payms Ransomware launcher and the text files associated with it does not help the situation either. Of course, that does not mean that you should not remove this ransomware. Of course, if you erase this threat, you might lose the opportunity to decrypt your personal files. So, what we recommend is figuring out what you want to do before you erase the infection. Are you willing to pay the ransom? Well, paying the ransom – or dealing with cyber criminals in any other way – is extremely risky because you are at risk of losing your money for no good reason. What is more, paying the ransom is completely unnecessary if your personal files are backed up outside of your operating system. On top of that, you might be able to employ third-party decryption tools to have your files “released” for no fee at all.

Hopefully, you manage to have your files restored, and you do not need to communicate with cyber criminals for that. Once the situation with your files is solved, you should proceed with the elimination of the ransomware. Because this threat is extremely malicious and clandestine, our recommendation for you is to use automated malware detection and removal software. Sure, you might be able to detect and remove Payms Ransomware components within your PC and the Windows Registry, but this is something that only experienced users should venture into. If you are positive you can erase malware manually, start by deleting the malicious launcher (e.g., the file attacked to a spam email that was used for the execution of this ransomware) and the text files carrying the message by cyber criminals. Once you clean your PC, regardless of how you do it, employ a reliable security tool to protect your operating system. If you do not do this, ransomware will attack again.