Pay Us Ransomware 🔐 (. Pay Us File) — Removal Guide

What is Pay us virus?

Pay us appends its own .pay us extension to the name of every encoded file. For example, an image entitled “photo.jpg” will be renamed to “photo.jpg.pay us”. In the same manner, the Excel sheet named “table.xlsx” will become “table.xlsx.pay us”, and so on.

In every directory with the encoded files, a read_me.txt file will be found. It is a ransom money note. It contains information about the ways of contacting the racketeers and some other remarks. The ransom note usually contains instructions on how to buy the decryption tool from the Pay us developers. That is pretty much the scheme of the malefaction.

The read_me.txt file coming in package with the Pay us ransomware provides the following dispiriting information:

All of your files have been encrypted
Your computer was infected with a ransomware virus. Your files have been encrypted and you won\'t
be able to decrypt them without our help.What can I do to get my files back?You can buy our special
decryption software, this software will allow you to recover all of your data and remove the
ransomware from your computer.The price for the software is $1,500. Payment can be made in Bitcoin only.
How do I pay, where do I get Bitcoin?
Purchasing Bitcoin varies from country to country, you are best advised to do a quick google search
yourself  to find out how to buy Bitcoin.
Many of our customers have reported these sites to be fast and reliable:
Coinmama - hxxps:// Bitpanda - hxxps://

 

Payment informationAmount: 0.1473766 BTC
Bitcoin Address:  bc1qw0ll8p9m8uezhqhyd7z459ajrk722yn8c5j4fg

In the image below, you can see what a directory with files encrypted by the Pay us looks like. Each filename has the “.pay us” extension added to it.

How did my computer get infected with Pay us ransomware?

There are currently three most exploited ways for hackers to have the Pay us virus working in your digital environment. These are email spam, Trojan injection and peer networks.

If you access your inbox and see letters that look just like notifications from utility services providers, delivery agencies like FedEx, Internet providers, and whatnot, but whose addresser is unknown to you, beware of opening those letters. They are very likely to have a malicious file enclosed in them. So it is even riskier to download any attachments that come with emails like these.

Another thing the hackers might try is a Trojan file scheme³. A Trojan is a program that infiltrates into your computer disguised as something legal. For example, you download an installer for some program you need or an update for some software. However, what is unboxed turns out to be a harmful agent that corrupts your data. As the update file can have any title and any icon, you’d better be sure that you can trust the source of the stuff you’re downloading. The best thing is to trust the software developers’ official websites.

As for the peer-to-peer file transfer protocols like BitTorrent or eMule, the threat is that they are even more trust-based than the rest of the Internet. You can never guess what you download until you get it. So you’d better be using trustworthy websites. Also, it is reasonable to scan the folder containing the downloaded items with the antivirus as soon as the downloading is finished.