PayDOS Ransomware - How to remove

PayDOS ransomware is another ransomware detected by cyber security researcher at Avast Jakub Kroustek. This ransomware program runs on Windows operating system. Though, in the ransom note, as all of the ransomware coders, the clip-artist/-s behind PayDos virus claims that the files have been encrypted, though they have actually only been renamed. The peculiar point of PayDOS ransomware virus is that its executable file is a batch file, running within the Windows CMD (command) prompt. Thus, it is called a batch file ransomware or a command prompt ransomware. PayDos malware is also regarded as a developmental version, since its ransom message contains no contact details to pay the ransom demanded.

The Manner in Which the PayDOS Ransomware Acts

Once the batch file of PayDOS ransomware has been executed, it is located at the %Temp% folder. Then, the scan is started. The compromised computer’s system is scanned for the certain files to be encrypted. When the scan is over and all the targeted files have been found, they are renamed by replacing one letter of the extension with another random one. For instance, My_photo.png file is renamed into My_Photo.dng. All files, having the same extension will be renamed in the same pattern:

Such renamed data containers are not encrypted, but they cannot be opened as they used to be, before the renaming has taken place. However, a queer thing is that, the victim does not need to receive the password from the hacker to be able to open the renamed files. He should only rename the files back to their original names, by simply changing the ill letter of the extension, and the files will be available to be used as normally. However, the ransom in the pop-up window is still displayed:

0.33 BTC (bitcoin) is asked as a ransom payment. It is 232.17 USD, which is quite a money taking into consideration that you yourself can get access to your data in a very simple way and without paying a cent to the cyber criminals. This is the most clear and concrete part of the note. There is no useful information besides the ransom money in the message. The hacker lies about the encryption. And he does it in a very broken English.

How Can You Have a Rendezvous with PayDOS Ransomware?

Despite the fact that PayDOS ransomware is coded in the manner not typical of the most recent ransomware viruses, its distribution methods are quite common among those of the majority of ransomware viruses, which belong to the category of trojan viruses. These encompass the infected spam e-mail attacks, the corrupted advertisements and downloads. Thus, if the user is willing to avoid a rendezvous with PayDOS, he must comply with the standard rules for cyber hygiene, one of which is at all times having an updated and trustworthy security application, such as Spyhunter, running on one computer’s system.

How to Remove PayDOS Ransomware?

You do not need to search for complicated ways to decrypt your files, since they have never been encrypted by PayDOS trojan. And the simple way, which lets you to again be able to open your files does not require to install any additional software on your PC, or any other tools or devices to be used. However, you still need to remove this malicious program from your computer. Even though PayDOS malware is not the most dangerous ransomware you can possibly encounter with, if you download a licensed security application, it will secure your computer’s system from any future malware attacks. You can choose Spyhunter or Malwarebytes. You can also remove the ransomware manually. In order to be successful follow the tutorial below.

How to recover PayDOS Ransomware encrypted files and remove the virus

Step 1. Restore system into last known good state using system restore

1. Reboot your computer to Safe Mode with Command Prompt:

for Windows 7 / Vista/ XP

• Start → Shutdown → Restart → OK.
• Press F8 key repeatedly until Advanced Boot Options window appears.
• Choose Safe Mode with Command Prompt.

for Windows 8 / 10

• Press Power at Windows login screen. Then press and hold Shift key and click Restart.
• Choose Troubleshoot → Advanced Options → Startup Settings and click Restart.
• When it loads, select Enable Safe Mode with Command Prompt from the list of Startup Settings.

 

2.Restore System files and settings.

• When Command Prompt mode loads, enter cd restore and press Enter.
• Then enter rstrui.exe and press Enter again.
• Click “Next” in the windows that appeared.
• Select one of the Restore Points that are available before PayDOS Ransomware has infiltrated to your system and then click “Next”.
• To start System restore click “Yes”.

 

Step 2. Complete removal of PayDOS Ransomware

After restoring your system, it is recommended to scan your computer with an anti-malware program, like Spyhunter and remove all malicious files related to PayDOS Ransomware. You can check other tools here.  

Step 3. Restore PayDOS Ransomware affected files using Shadow Volume Copies

If you do not use System Restore option on your operating system, there is a chance to use shadow copy snapshots. They store copies of your files that point of time when the system restore snapshot was created. Usually PayDOS Ransomware tries to delete all possible Shadow Volume Copies, so this methods may not work on all computers. However, it may fail to do so. Shadow Volume Copies are only available with Windows XP Service Pack 2, Windows Vista, Windows 7, and Windows 8. There are two ways to retrieve your files via Shadow Volume Copy. You can do it using native Windows Previous Versions or via Shadow Explorer. a) Native Windows Previous Versions Right-click on an encrypted file and select Properties → Previous versions tab. Now you will see all available copies of that particular file and the time when it was stored in a Shadow Volume Copy. Choose the version of the file you want to retrieve and click Copy if you want to save it to some directory of your own, or Restore if you want to replace existing, encrypted file. If you want to see the content of file first, just click Open.

b) Shadow Explorer It is a program that can be found online for free. You can download either a full or a portable version of Shadow Explorer. Open the program. On the left top corner select the drive where the file you are looking for is a stored. You will see all folders on that drive. To retrieve a whole folder, right-click on it and select “Export”. Then choose where you want it to be stored.

Step 4. Use Data Recovery programs to recover PayDOS Ransomware encrypted files

There are several data recovery programs that might recover encrypted files as well. This does not work in all cases but you can try this:

• We suggest using another PC and connect the infected hard drive as slave. It is still possible to do this on infected PC though.
• Download a data recovery program.
• Install and scan for recently deleted files.

Note: In many cases it is impossible to restore data files affected by modern ransomware. Thus I recommend using decent cloud backup software as precaution. We recommend checking out Carbonite, BackBlaze, CrashPlan or Mozy Home.