BTCWare-PayDay Ransomware Removal Guide

If BTCWare-PayDay Ransomware finds a way to enter your system, you may be left with encrypted files that you will never be able to use again. The ransomware infection can be a real nightmare as there is no free tool yet on the web that you could use to restore your files with. Our research indicates that this infection might be a new BTCWare Ransomware variant. We have found that this threat can use several extensions and may also use different e-mail addresses through which you are supposed to contact these criminals for further details and instructions on the payment. As most of the time, you have to pay a ransom fee in Bitcoins. This prices is said to be based on how fast you react to this malicious attack. However, our experience shows that paying ransom free to criminals rarely end well for the victims. Two scenarios are more likely than such crooks actually sending you the decryption tool. First, these cyber crooks may just disappear into thin air and second, they may send you another malicious threat disguised as your decryption software. All in all, it is important that you remove BTCWare-PayDay Ransomware from your computer as soon as possible so that you can restore your system and copy your backed up file back onto your hard disk if have a backup.

It is quite likely that you have received a spam e-mail lately and you clicked to view its attachment. This is how most ransomware programs are spread over the net actually. It may be shocking to learn that it was you who most likely let this beast on board. Still, it is essential that you understand how this was possible so that you can avoid similar threats in the future at least. Such a spam may look totally authentic and may not even raise suspicion. Most of the time it may regard matters like unsettled invoices, issues with credit card details and online bookings, and so on. People are usually quite the curious type; therefore, most of them cannot resist temptation and would like to see what such a mail contains. However, opening such a spam would only take you one step closer to downloading the attached malicious file as you would be made to believe that this attachment has all the information you need to know about the matter in question. The problem is that you cannot delete BTCWare-PayDay Ransomware from your computer without losing your files. Thus, it is vital that you become more careful around your spam and inbox folders.

It is also a possibility that you get infected by landing on the wrong website operated by cyber crooks. There are lots of pages on the web that serve as traps, i.e., programmed with Exploit Kits to exploit older browser and driver versions to drop such an infection without your knowledge. You can easily get redirected to such a malicious page if you click on unsafe third-party ads or links, or when your computer is infected with adware. You should know that once your browser loads such a page, the malicious script is triggered and it drops this infection right away behind your back. This is why it is essential that you keep all your software updated actually to prevent such terrible attacks from happening. Deleting BTCWare-PayDay Ransomware will not save or recover your files. Therefore, prevention is very important when it comes to such dangerous malware infections.

This ransomware can encrypt all your important files, including your photos, videos, documents, and databases as well. This is how these criminals can try to extort money from you for the decryption tool, which is supposed to be the only way for you to get your encrypted files back. Your affected files get a ".[payday@cryptmaster.info]-id-140.payday" extension; although, we have found other variants where it was with different e-mail or ID like ".[decryptorx@cock.li]-id-0.payday," ".[aversia@tuta.io]-id-0.payday," or ".[keyforyou@tuta.io]-id-0.payday." This malware infection is supposed to drop a ransom note text file called "!! RETURN FILES !!.txt" but our samples did not do so. This ransomware also creates an .hta ransom note file in your "%APPDATA%" folder called "payday.hta" that is displayed once the encryption is over.

This ransom note informs you about the attack and that you have to send an e-mail "keyforyou@tuta.io," "payday@cryptmaster.info," or it could be a different one depending on your variant, in order to have further instructions regarding the payment. You can send up to 3 files to have them decrypted for free but their size cannot exceed 1Mb. We do not advise you to contact these criminals because there is no guarantee that they will send you the decryption tool even if you transfer the money. We have no information about the amount of the fee but it can be anything from 10 USD up to 2,000 USD worth of Bitcoins. Please note that removing BTCWare-PayDay Ransomware from your computer will not recover your encrypted files but this is still your only option if you want to use your computer again.

Hopefully, you have a backup of your most important files in cloud storage or on a removable drive so that you can restore those files after you eliminate this dangerous ransomware. If not, this could be your worst day ever as you may lose all the encrypted files. We have prepared a guide for you to be able to remove BTCWare-PayDay Ransomware without leaving leftovers on your system. If you do not feel comfortable with manual removal, we suggest that you use a professional anti-malware program like SpyHunter to take care of all possible threats automatically.

How to remove BTCWare-PayDay Ransomware from Windows

1. Press Win+R and type regedit. Click OK.
2. Locate and delete these registry value names:
   HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run | payday | "C:\Users\user\AppData\Roaming\payday.hta"
   HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run | baby | "C:\Users\user\AppData\Roaming\payday.hta"
3. Close the editor.
4. Press Win+E.
5. Delete the ransom note file, "%APPDATA%\payday.hta"
6. Empty your Recycle Bin.
7. Reboot your computer.