Pidon Ransomware - How to remove

Pidon is a computer virus and file-encrypting ransomware. If you’re ready with file backups, Pidon will just waste some of your time. In worst cases, though, Pidon can cost people all of their personal files, and even infect their computers with more viruses. The developers of Pidon have been developing and spreading ransomware for half a year now and what they’re doing is absolutely illegal.

What is Pidon?

Pidon ransomware is a new variant of the DJVU ransomware. It’s been discovered by @demonslay335. It gets on a computer, starts encrypting files, then drops a text file with a message from Pidon’s developers asking for money ($490 or $980) to restore the files.
The name of the ransom note is _readme.txt. The text in the ransom note has barely changed at all form the previous versions of STOP/DJVU: Drume, Kroput, Davda. It’s not entirely obvious from the note, but the people writing this message are the ones responsible for corrupting your files.

picture.jpg.pidon

The encrypted files are renamed by having .pidon appended to their names. The extortionists are correct when they say:

The only method of recovering files is to purchase decrypt tool and unique key for you.

The way that public-key cryptography works is that you cannot decrypt files if you don’t have the unique decryption key. And only Pidon’s developers know the private keys necessary to decrypt the files. You might never be able to decrypt the files, but there are other ways to try to get your data back — follow the guide below to see if you can restore some of your data.

Also, try STOPDecrypter (Download) — a program that @demonslay335 created and that can decrypt the files which were encrypted with the offline key, which is used when Pidon cannot connect to the C&C server.

The contact information of the criminals is [email protected], [email protected], and @datarestore (Telegram). If you want to pay the ransom to get your files back, do it only if you’re ready to lose hundreds or even thousands of dollars. For one, Pidon’s developers are likely to not restore the files. Only around 60% of those who paid the ransom manage to restore their files. And then there are those people who take the ransom, instead of providing the decryption key, demand more money. And there’s nothing that the victim can do — the transactions are done in cryptocurrency and can’t be reversed or recalled. That money is gone forever.

How does ransomware infect computers?

Remote Desktop Protocol being hacked is how a lot of ransomware viruses infect computers. It is a very scary way to get infected because you don’t even need to do anything. Criminals can access your computers and install viruses on their own. However, this strategy is used to target companies and businesses, while Pidon’s victims are more likely to be individuals.

Fake updaters and installers spread Pidon. You might think that you’re downloading a legitimate program, but malicious actors find ways to disguise their viruses or wrap them in reputable software.

E-mails and messages are used by various online criminals and spammers to spread malicious links and files. Pidon can be hiding in a file even as innocent as a document. The trick is to get the recipient to run the file. To achieve this, criminals come up with various psychological tricks.

Here’s something to be concerned about — frequently, Pidon’s relatives have been distributed together with other, even more serious viruses, like banking trojans. If you have spyware while doing online banking on your computer, that could be very dangerous. You might expect your antivirus program to tell you if you have it, except that Pidon’s predecessors have been able to cripple the installed antivirus programs and stop them from properly functioning.

Just make sure to be careful of suspicious files online. Make sure you don’t keep all your eggs in one basket and back your files. Backups are very useful in more situations than just the Pidon ransomware.

How to remove Pidon

If you’re having trouble connecting to cybersecurity websites, look into this guide. Pidon could mess with your settings in the hosts file.

Pidon should be removed so that it doesn’t repeatedly encrypt your files. If you attempt to use your computer while Pidon is still on it, it’ll just encrypt the newly created files. Any other viruses and PUPs should be removed, too. That’s simple to do using a professional antivirus program, such as Spyhunter.

How to recover Pidon Ransomware encrypted files and remove the virus

Step 1. Restore system into last known good state using system restore

1. Reboot your computer to Safe Mode with Command Prompt:

for Windows 7 / Vista/ XP

• Start → Shutdown → Restart → OK.
• Press F8 key repeatedly until Advanced Boot Options window appears.
• Choose Safe Mode with Command Prompt.

for Windows 8 / 10

• Press Power at Windows login screen. Then press and hold Shift key and click Restart.
• Choose Troubleshoot → Advanced Options → Startup Settings and click Restart.
• When it loads, select Enable Safe Mode with Command Prompt from the list of Startup Settings.

 

2.Restore System files and settings.

• When Command Prompt mode loads, enter cd restore and press Enter.
• Then enter rstrui.exe and press Enter again.
• Click “Next” in the windows that appeared.
• Select one of the Restore Points that are available before Pidon Ransomware has infiltrated to your system and then click “Next”.
• To start System restore click “Yes”.

 

Step 2. Complete removal of Pidon Ransomware

After restoring your system, it is recommended to scan your computer with an anti-malware program, like Spyhunter and remove all malicious files related to Pidon Ransomware. You can check other tools here.  

Step 3. Restore Pidon Ransomware affected files using Shadow Volume Copies

If you do not use System Restore option on your operating system, there is a chance to use shadow copy snapshots. They store copies of your files that point of time when the system restore snapshot was created. Usually Pidon Ransomware tries to delete all possible Shadow Volume Copies, so this methods may not work on all computers. However, it may fail to do so. Shadow Volume Copies are only available with Windows XP Service Pack 2, Windows Vista, Windows 7, and Windows 8. There are two ways to retrieve your files via Shadow Volume Copy. You can do it using native Windows Previous Versions or via Shadow Explorer. a) Native Windows Previous Versions Right-click on an encrypted file and select Properties → Previous versions tab. Now you will see all available copies of that particular file and the time when it was stored in a Shadow Volume Copy. Choose the version of the file you want to retrieve and click Copy if you want to save it to some directory of your own, or Restore if you want to replace existing, encrypted file. If you want to see the content of file first, just click Open.

b) Shadow Explorer It is a program that can be found online for free. You can download either a full or a portable version of Shadow Explorer. Open the program. On the left top corner select the drive where the file you are looking for is a stored. You will see all folders on that drive. To retrieve a whole folder, right-click on it and select “Export”. Then choose where you want it to be stored.

Step 4. Use Data Recovery programs to recover Pidon Ransomware encrypted files

There are several data recovery programs that might recover encrypted files as well. This does not work in all cases but you can try this:

• We suggest using another PC and connect the infected hard drive as slave. It is still possible to do this on infected PC though.
• Download a data recovery program.
• Install and scan for recently deleted files.

Note: In many cases it is impossible to restore data files affected by modern ransomware. Thus I recommend using decent cloud backup software as precaution. We recommend checking out Carbonite, BackBlaze, CrashPlan or Mozy Home.