How to remove Payms ransomware virus

What does Payms virus do?

Payms virus is yet another example of ransomware. This threat was created based on Jigsaw virus code, which is reportedly on sale in Dark Web forums for 139 USD. This virus encrypts victim’s files and demands 150 USD, but if the victim does not pay within 24 hours, the ransom price increases to 225 USD. However, it seems that cyber criminals ask for way smaller ransoms than they used to because computer users are already aware of ransomware threats, and also the majority of them refuse to pay the ransom.

Payms ransomware adds .pay, .payms or .paymst file extensions to encrypted files, and leaves ransom notes in the computer system, called Payment_Instructions.txt. You can find a copy of this file on the desktop, as well as in all folders that contain some encrypted data. The ransom note informs the victim that all data on the computer has been encrypted, and there is no other way to decrypt it than to pay a ransom. The note is written in English and Spanish languages, and it also informs that if the victim attempts to tamper with the virus, all files will be deleted. It provides instructions on how to buy Bitcoins and says that the victim must transfer them to a provided address if he/she wants to access his/hers files ever again. According to crooks, they will eliminate the virus and decrypt the data after the payment is made.

However, you should not rush to pay the ransom, even if 150 USD or 225 USD does not seem like a big sum of money to you. Cyber security experts have already updated a tool that can decrypt files locked by JigSaw ransomware, and now it can decrypt data that Payms malware encrypts. Therefore, just remove this malware using an anti-malware software (for example, FortectIntego) and then download this Payms decryption tool. On page 2, you can find detailed instructions how to install the anti-malware program on an infected machine and complete Payms removal.

How to protect your computer from ransomware attack?

Ransomware viruses still spread rapidly, and many computer users still do not know how to protect their computer from them. These facts about ransomware distribution methods will help you to understand how these viruses spread.

• Ransomware threats can be installed alongside fake software updates; in most cases, they spread in conjunction with fake Adobe Flash Player updates. To install real Java update, you should head to official website of Adobe;
• Cyber criminals create malicious files, make them look like safe ones (for example, invoices or speeding tickets) and send them directly to victims via email. For this reason, never open email attachments sent to you by unknown people or companies!
• Think before you click. If you are browsing through unknown websites, refrain from clicking on suspicious ads or links. Advanced cyber criminals use the clickjacking technique to conceal malicious scripts behind safe-looking content;
• If the computer was infected with a Trojan a while ago, it can also download ransomware or another computer threat and execute it at any moment.

To protect your computer and files from ransomware attack, install a reliable anti-malware software and backup your files to an external drive. Bear in mind that ransomware threats can encrypt files on all removable drives that are plugged into a compromised computer, so it is advisable to unplug the drive from the computer after you import data copies into it. Do not forget to delete suspicious emails from your inbox and resist the curiosity to open them.

How to remove Payms virus?

In order to remove Payms ransomware, you should install a reliable anti-malware program and scan your computer with it. There is a great chance that Payms malware might try to stop you from installing and running the anti-malware program, so we strongly recommend you to start your computer in Safe mode first. You can find detailed Payms removal instructions below.