Severity scale:  

Remove Usam ransomware (Virus Removal Instructions) - Decryption Methods Included

removal by Linas Kiguolis - - | Type: Ransomware

Usam ransomware is a cryptovirus that belongs to the STOP / Djvu ransomware family 

Usam ransomware virus

Usam ransomware – a highly-malicious malware that locks the data on the Windows machine and blackmails victims to extort the money. The criminals behind this file-encrypting virus[1] are infamous hackers that have launched STOP / Djvu ransomware a couple of years back and managed to release 233 new versions of the same virus. 

The Usam virus is the latest Djvu version, which stands 233 on the list. First spotted in the middle of June 2020, the malware is actively distributed via software cracks, keygens, and unprotected RDPs. If the unsuspecting victim launches the ransomware payload, the virus immediately encrypts most of the non-personal files (music, videos, photos, documents, etc.) with the .usam extension, thus completely restricting the user’s access to them.

Questions about Usam ransomware

Unfortunately, .usam files cannot be decrypted for free. Even though there’s an official STOPdecryptor available for anyone, it is fully functional with the old Djvu versions that have been launched before the autumn of 2019. Based on the information provided on the _readme.txt file, the victims of this virus are supposed to transfer $490 in Bitcoins within 72 hours after having a conversation with criminals via or email.

Name  Usam
Lineage  STOP / Djvu
Classification   Ransomware
Extension  .usam files is a distinctive feature of this new Djvu strain
Emails  victims have to contact hackers via, email, or @datarestore telegram account
Encryption/decryption  The virus uses an RSA encryption algorithm that generates unique online IDs that cannot be extracted. Cybersecurity experts keep looking for the flaws that would allow them to crack and leak IDs to help people decrypt .usam files. Note that the only reliable way to retrieve the locked files is to use backups.
Ransom Criminals demand people pay $490 or $980 ransom in Bitcoin cryptocurrency
Effect on the OS The ransomware-type viruses cause harm not only to personal files. This type of threat is programmed to cause multiple system infringements on Windows registries, bootup processes, and others.  Consequently, the system may start crashing, displaying errors, running into BSODs, etc. To prevent this from happening, take advantage of the Reimage Reimage Cleaner Intego repair utility
Elimination Ransomware files cannot be eliminated manually since it’s not possible to understand which of the running files are malicious. This process can be initiated with a robust anti-virus program only

Usam ransomware virus belongs to the Djvu family – this fact tells almost everything about the virus for the users who are interested in cybersecurity. In fact, all the variants that belong to this gang released after August 2019 are identical. Thus, taking a glance at its siblings, such as .kkll.nlah.pezi.covm, .zwer, and many others are more or less the same, except file extensions and (in some cases) email addresses of the criminals differ. 

If the Usam ransomware gets installed on the machine, first of all, it performs various changes on the Windows system with an intention to evade detection, ensure the successful launch of the encryption software, and grand persistence. For that, it may create malicious entries within %AppData%, %User% or %Temp% directories, run the PowerShell commands under administrative privileges to remove Shadow Volume Copies, disable AV program, and can download data-stealing Trojan Azorult as a secondary payload. These changes are not definite, thus dealing with ransomware means many problems with the system’s performance if Usam ransomware removal is not performed immediately. 

The successful Usam ransomware infiltration is followed by a complete lockdown of personal files and the informational note dubbed as _readme.txt presentation on the desktop and other system folders. The note says:


Don’t worry, you can return all your files!

All your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.
The only method of recovering files is to purchase decrypt tool and unique key for you.
This software will decrypt all your encrypted files.
What guarantees you have?
You can send one of your encrypted file from your PC and we decrypt it for free.
But we can decrypt only 1 file for free. File must not contain valuable information.
You can get and look video overview decrypt tool:
Price of private key and decrypt software is $980.
Discount 50% available if you contact us first 72 hours, that’s price for you is $490.
Please note that you’ll never restore your data without payment.
Check your e-mail “Spam” or “Junk” folder if you don’t get answer more than 6 hours.

To get this software you need write on our e-mail:

Reserve e-mail address to contact us:

Your personal ID:

Seeing .usam files on the machine and have no access to personal files is a frustrating experience. However, paying the ransom is highly not recommended as you can unconsciously uncover personal details to criminals or experience another phony if criminals decide not to provide you with a functional Usam ransomware decryptor. 

If you have file backups, there’s no reason for you to worry. Remove Usam virus from the system using updated anti-virus software. Do not try to eliminate malicious entries manually as you can accidentally delete some core Windows entries and, subsequently, trigger more Windows malfunctions. 

Usam ransomware removal is a process that can only be performed with professional security software with an updated virus database. You can attempt to recover your encrypted files only after a full elimination of file-encrypting viruses. Our team has submitted a tutorial on how to decrypt .usam files without paying the ransom (at the end of the article). 

Usam crypto-ransomwareUsam is the name of the file-encrypting ransomware, which is the 233 variant of the STOP/Djvu gang

Alternative methods to unlock inaccessible .usam files

The main trait allowing to stand the Usam ransomware virus from the crowd is its distinctive file extension. Thus, if you have noticed that the icons of your files became all the same (plain white icon) with a unified .usam extension appendix, there’s no doubt that the file-encrypting Djvu family member has hacked your machine. 

Unfortunately, .usam file decryption is not possible without paying the ransom or using original file backups. If you have no backups or money to pay the criminals, there are very few changes that important work, documents, or family photos will be recovered. 

As we have pointed out, one of the ways to decrypt Djvu files, including .usam encrypted files is to use a free Emsisoft’s decryption software. However, don’t give a lot of traction to this software as it can only unlock files for the versions using offline IDs. If you don’t want to be dejected by the unsuccessful decryption process, you can check whether your files have been encrypted using offline or online IDs by opening C: drive and accessing SystemID.txt. This directory contains all encrypted data. If you see some entries with the names ending with “t1,” then the free Emsisoft’s decryptor might work. 

Otherwise, the .usam file virus can be eliminated using third-party data recovery tools like Data Recovery Pro, Shadow Volume Copies or System Restore feature. You can find a full guide for the decryption methods at the end of this article. 

IMPORTANT: criminals have launched a fake DJVU decryptor which may be found on various discussion forums, torrenting sites, or other sites. This decryptor not only fails to unlock files. In fact, it’s another ransomware that drops a malicious crab.exe file, which downloads new Zorab ransomware[2] and encrypts already encrypted files with .ZRB file extension. 

The most common ransomware distribution methods listed 

Hackers are using sophisticated methods to trick people into downloading malicious ransomware viruses. That’s a commonly known fact. However, millions of less tech-savvy people are still paying no attention to the websites they land on, to the content they download, to the ads they click, to the updates they download, and so on. 

Therefore, we keep trying to increase people’s consciousness and grow their perception of cybersecurity by publishing the news on how hackers spread their newborn viruses or what new means have been invented to distribute good-old cyber infections. The team of cybersecurity experts from[3] has provided us with a list of most widely used Djvu ransomware distribution techniques, which is the following:

  • Djvu ransomware family is most frequently distributed via cracks, keygens, loaders, and similar tools. If you are about to download a software crack to hack the license of Windows, Adobe Acrobat, Adobe Photoshop, game keygens, etc. 
  • Fake software updates. If the machine is infected by a rather aggressive adware-type malware, web browsers can redirect to sites infected with malicious scripts or display infected ads that once clicked download ransomware payload. 
  • Malicious spam email attachments. People can receive catchy email messages that contain ZIP, PDF, Microsoft Word attachments that ask people to enable  Macros to view the content. DO NOT enable the supposed macros to open questionable attachments sent by unreliable senders. That’s a scheme used by hackers to spread ransomware, trojans, spyware, and other cyber threats. 

To protect yourself from ransomware attacks, you should rely on a reputable AV security suite, which has in-built real-time protection, email filter, and other additional features. 

Usam virus detectionUsam virus files can be detected by some AV tool while others do not recognize them as malicious

Usam ransomware removal options: no manual removal possibilities

There is no option to remove Usam ransomware virus manually. Victims should understand that the virus initiates too many changes on the system and runs too many malicious processes to be detected and eliminated without the help of professionals.

Although you can find some malicious entries as they may suck up CPU resources or display errors, there are very few chances that you will be allowed to disable any of them manually. Usam virus grants itself administrative privileges and, therefore, all related files are run “legally.”

Having this in mind, we strongly recommend you make a cold copy of the .usam files using a USB stick, external hard drive, or cloud and then perform a full Usam removal using an automated anti-virus program. For this purpose, you should use Malwarebytes, SpyHunter 5Combo Cleaner, or another reputable anti-malware suite. 

Upon ransomware elimination, try to recover Windows system to the previous state by restoring Windows registry entries, startup files, and core processes. For that, take advantage of the Reimage Reimage Cleaner Intego recover tool. Finally, you can try to retrieve the locked files using alternative methods listed below.

do it now!
Reimage Happiness
Intego Happiness
Compatible with Microsoft Windows Supported versions Compatible with OS X Supported versions
What to do if failed?
If you failed to remove virus damage using Reimage Intego, submit a question to our support team and provide as much details as possible.
Reimage Intego has a free limited scanner. Reimage Intego offers more through scan when you purchase its full version. When free scanner detects issues, you can fix them using free manual repairs or you can decide to purchase the full version in order to fix them automatically.
Alternative Software
Different software has a different purpose. If you didn’t succeed in fixing corrupted files with Reimage, try running SpyHunter 5.
Alternative Software
Different software has a different purpose. If you didn’t succeed in fixing corrupted files with Intego, try running Combo Cleaner.

To remove Usam virus, follow these steps:

Remove Usam using Safe Mode with Networking

If Usam virus prevents your AV engine from being launched, access Safe Mode with Networking to disable malicious executables:

  • Step 1: Reboot your computer to Safe Mode with Networking

    Windows 7 / Vista / XP
    1. Click Start Shutdown Restart OK.
    2. When your computer becomes active, start pressing F8 multiple times until you see the Advanced Boot Options window.
    3. Select Safe Mode with Networking from the list Select 'Safe Mode with Networking'

    Windows 10 / Windows 8
    1. Press the Power button at the Windows login screen. Now press and hold Shift, which is on your keyboard, and click Restart..
    2. Now select Troubleshoot Advanced options Startup Settings and finally press Restart.
    3. Once your computer becomes active, select Enable Safe Mode with Networking in Startup Settings window. Select 'Enable Safe Mode with Networking'
  • Step 2: Remove Usam

    Log in to your infected account and start the browser. Download Reimage Reimage Cleaner Intego or other legitimate anti-spyware program. Update it before a full system scan and remove malicious files that belong to your ransomware and complete Usam removal.

If your ransomware is blocking Safe Mode with Networking, try further method.

Remove Usam using System Restore

If the previous method failed to work, try eliminating the ransomware using System Restore point.

  • Step 1: Reboot your computer to Safe Mode with Command Prompt

    Windows 7 / Vista / XP
    1. Click Start Shutdown Restart OK.
    2. When your computer becomes active, start pressing F8 multiple times until you see the Advanced Boot Options window.
    3. Select Command Prompt from the list Select 'Safe Mode with Command Prompt'

    Windows 10 / Windows 8
    1. Press the Power button at the Windows login screen. Now press and hold Shift, which is on your keyboard, and click Restart..
    2. Now select Troubleshoot Advanced options Startup Settings and finally press Restart.
    3. Once your computer becomes active, select Enable Safe Mode with Command Prompt in Startup Settings window. Select 'Enable Safe Mode with Command Prompt'
  • Step 2: Restore your system files and settings
    1. Once the Command Prompt window shows up, enter cd restore and click Enter. Enter 'cd restore' without quotes and press 'Enter'
    2. Now type rstrui.exe and press Enter again.. Enter 'rstrui.exe' without quotes and press 'Enter'
    3. When a new window shows up, click Next and select your restore point that is prior the infiltration of Usam. After doing that, click Next. When 'System Restore' window shows up, select 'Next' Select your restore point and click 'Next'
    4. Now click Yes to start system restore. Click 'Yes' and start system restore
    Once you restore your system to a previous date, download and scan your computer with Reimage Reimage Cleaner Intego and make sure that Usam removal is performed successfully.

Bonus: Recover your data

Guide which is presented above is supposed to help you remove Usam from your computer. To recover your encrypted files, we recommend using a detailed guide prepared by security experts.

The methods listed below can be safely tried, though there’s no guarantee that any of them work. Nevertheless, if you don’t have backups and have no intentions to pay the criminals for a Usam decryption software, the following tips may help you to get back at least some of your files. 

If your files are encrypted by Usam, you can use several methods to restore them:

Download Data Recovery Pro and run a scan to see if the software is capable of recovering any of the .usam file virus entries

  • Download Data Recovery Pro;
  • Follow the steps of Data Recovery Setup and install the program on your computer;
  • Launch it and scan your computer for files encrypted by Usam ransomware;
  • Restore them.

If you have enabled System Restore prior to the ransomware attack, try to get your files back with the help of the Windows Previous Versions feature

  • Find an encrypted file you need to restore and right-click on it;
  • Select “Properties” and go to “Previous versions” tab;
  • Here, check each of available copies of the file in “Folder versions”. You should select the version you want to recover and click “Restore”.

Shadow Volume Copies are not likely to help in this case since Djvu family is programmed to command Windows to delete these copies.

  • Download Shadow Explorer (;
  • Follow a Shadow Explorer Setup Wizard and install this application on your computer;
  • Launch the program and go through the drop down menu on the top left corner to select the disk of your encrypted data. Check what folders are there;
  • Right-click on the folder you want to restore and select “Export”. You can also select where you want it to be stored.

No free Usam decryptor available

The latest versions of STOP/Djvu cannot be decrypted using the Emsisoft’s decryptor as it works with offline keys only. If, however, you want to give this tool a try, you can download it from the official website

Finally, you should always think about the protection of crypto-ransomwares. In order to protect your computer from Usam and other ransomwares, use a reputable anti-spyware, such as Reimage Reimage Cleaner Intego, SpyHunter 5Combo Cleaner or Malwarebytes

Choose a proper web browser and improve your safety with a VPN tool

Online spying has got momentum in recent years and people are getting more and more interested in how to protect their privacy online. One of the basic means to add a layer of security – choose the most private and secure web browser. Although web browsers can't grant a full privacy protection and security, some of them are much better at sandboxing, HTTPS upgrading, active content blocking, tracking blocking, phishing protection, and similar privacy-oriented features. However, if you want true anonymity, we suggest you employ a powerful Private Internet Access VPN – it can encrypt all the traffic that comes and goes out of your computer, preventing tracking completely.


Recover files after data-affecting malware attacks

While much of the data can be accidentally deleted due to various reasons, malware is one of the main culprits that can cause loss of pictures, documents, videos, and other important files. More serious malware infections lead to significant data loss when your documents, system files, and images get encrypted. In particular, ransomware is is a type of malware that focuses on such functions, so your files become useless without an ability to access them.

Even though there is little to no possibility to recover after file-locking threats, some applications have features for data recovery in the system. In some cases, Data Recovery Pro can also help to recover at least some portion of your data after data-locking virus infection or general cyber infection. 


About the author
Linas Kiguolis
Linas Kiguolis - Expert in social media

If this free removal guide helped you and you are satisfied with our service, please consider making a donation to keep this service alive. Even a smallest amount will be appreciated.

Contact Linas Kiguolis
About the company Esolutions

Removal guides in other languages

Your opinion regarding Usam ransomware