PayDOS Ransomware

PayDOS Ransomware is a highly malicious application and its primary objective is to enter your computer by stealth and encrypt your personal documents to make you pay a ransom for the decryption tool required to decrypt them. If you want to remove this ransomware, then you have come to the right cyber security site, because this article is dedicated to providing you with information about this infection and its safe removal. Complying with the demands of its creators is risky because you might not get the promised pass code.

Unfortunately, there is little to no information about this infection because it was discovered only recently. Still, we want to give you an idea of how it might be disseminated and what precautions you can take to minimize the chances of your computer becoming infected with it. We believe that this newly released ransomware can be distributed via infected websites. These websites have some kind of embedded exploit kits that interacts with the web browser and using JavaScript and Flash vulnerabilities secretly downloads the malicious executable. Another possibility is that PayDOS Ransomware is distributed using malicious emails. Its developers could have set up a dedicated server that spams would-be victims with fake emails claiming that it is a receipt or a tax return form and that they should open the attached file archive or PDF file to view the information inside. The two distribution methods mentioned above are the most common ones used, so keep your PC protected with an antimalware application, be wary of odd emails, and do not visit questionable websites, particularly those that you know to feature illicit and pirated content.

If this ransomware were to infect your computer, then it would place its randomly named executable in a random location and connect to its command and control (C&C) server. Then, it would can your computer for encrypatable files and go to work. We have received information that PayDOS Ransomware is set to target pictures and documents in particular probably because they are more likely to feature personal and, thus, valuable information for which you would be willing to pay whatever sum of money the cyber criminals want you pay.

This particular ransomware requires 0.33 Bitcoins or an approximate 231.97 USD which is a substantial sum of money. You can try paying the ransom but there is no guarantee that the cyber criminals will send you the pass code. Therefore, we advise that you refrain from paying. However, a free decryption tool is not yet available and, in fact, the particular algorithm used to encrypt the files is not known as well. Nevertheless, it is more than likely that PayDOS Ransomware uses the RSA or AES encryption method and these two algorithms are known to be extremely difficult to crack and that is why they are as popular as they are among ransomware developers. However, if a ransomware has flaws, then cyber security experts can develop a free to use decryption tool and if your PC has been infected with PayDOS Ransomware, then we recommend that you delete it and wait for a free decryption tool to decrypt your files.

In closing, PayDOS Ransomware is one highly malicious infection that can encrypt your personal files and demand money for the pass code to decrypt them. Complying with the demands is not recommended as the developers might not hold their end of the bargain and send you the pass code. Therefore, we recommend that you remove it, but since its executable and additional files can be stored anywhere on your PC, we suggest using SpyHunter’s free scan to detect them and then going to the directories and deleting the files manually.

Removal Guide

1. Go to http://www.pcthreat.com/download-sph
2. Download SpyHunter-Installer.exe and run it.
3. Install the program and then run a full system scan.
4. Use the directories provided in the search results to find the malware.
5. Press Win+E and enter the file path in the address box.
6. Press Enter.
7. Right-click the malicious file(s) and click Delete.