Pluto Ransomware - How to remove

Pluto Ransomware can appear on your computer out of nowhere and cause all sorts of problems. It is classified as ransomware because it demands a ransom to be paid, so the damage caused by infection would be eliminated.

Obviously, it not too hard to notice that your computer has been infected with Pluto virus – all your files will be locked and marked with .pluto extension. That’s where the name of this infection originates from. Then, you will notice a new file on your desktop called “!!!READ_IT!!!.txt”. This file contains ransom note and it goes like this:

!!! ATTENTION, YOUR FILES WERE ENCRYPTED !!!

Please follow few steps below:

1.Send us your ID.


2.We can decrypt 1 not important file what would you make sure that we have decription tool! Do not try to cheat us, only not important file.


3.Then you’ll get payment instruction and after payment you will get your decryption tool!

Do not try to rename files!!! Only we can decrypt all your data!

Contact us:

[email protected]


[email protected]

Your ID:

Now, if you are in this situation, please continue reading the article. We will inform you about the specific features of Pluto virus, where does it come from and how to deal with it in the best way possible. Also, we will teach you how to protect your computer better, so this won’t happen again.

How Pluto Operates

The scheme of this infection is really common, used by many others. Ransomware infections like Maoloa or CryptoID also work in the same way. So first, it needs to upload malicious files on your computer. When that is done, the virus is automatically executed and it runs a scan of all files stored on your hard drive.

Unfortunately, Pluto is capable of encrypting various files, so you can expect the majority of your personal files to be locked with .pluto extension. What does that mean? It means the virus changed the structure of your files, so you can no longer open them. Certain cryptography is used in this process, and cyber criminals automatically generate the decryption key, which can be used to unlock files. Sadly, the key is kept in a remote server controlled by crooks, so literally, the only way to get it is to pay the ransom.

Luckily, Pluto ransomware won’t touch your systemic files, so you will be able to continue using your operating system. This provides the ability to install anti-malware tool, remove the virus itself and then restore damaged files. So as you can see, there is no need to pay the ransom.

Also, there is no need to contact cyber criminals. They provide 2 email addresses: [email protected] and [email protected]. We highly recommend not to contact them, nor pay the ransom.

How Pluto Infected Your Computer

So we have already mentioned that Pluto Ransomware needs some special files to automatically execute itself, thus their main goal is to get those files up on your computer. And they do that by attaching them to spam emails and sending them to thousands and thousands different, random (or not) email addresses.

That means you are the most likely to get infected with Pluto virus if via spam email. We always recommend staying away from emails that ended up on your spam folders, especially if they have some attached files.

It would be even better if you secured your system with a tool like IObit Malware Fighter, which features a dedicated tool for fighting against malware. Even if you are already infected, it is a good idea to protect your system and prevent similar viruses in the future.

Removal of Pluto Ransomware

Now, if the infection is already inside of your computer and your files are currently locked, the first thing you need to do is to remove the virus from it, before even attempting to recover your files. The best way to do that is to scan your computer with Spyhunter. Either one of those programs should be capable of detecting and removing Pluto Ransomware in minutes.

When the virus is gone, you can perform a system restore to turn your system back in time and unlock all your files – it’s a much better option than paying the ransom. Unfortunately, this method is only possible if you have a valid backup copy of your hard drive and it wasn’t corrupted by the ransomware. Also, you can try other alternatives – free ’file.

Automatic Malware removal tools

How to recover Pluto Ransomware encrypted files and remove the virus

Step 1. Restore system into last known good state using system restore

1. Reboot your computer to Safe Mode with Command Prompt:

for Windows 7 / Vista/ XP

• Start → Shutdown → Restart → OK.
• Press F8 key repeatedly until Advanced Boot Options window appears.
• Choose Safe Mode with Command Prompt.

for Windows 8 / 10

• Press Power at Windows login screen. Then press and hold Shift key and click Restart.
• Choose Troubleshoot → Advanced Options → Startup Settings and click Restart.
• When it loads, select Enable Safe Mode with Command Prompt from the list of Startup Settings.

 

2.Restore System files and settings.

• When Command Prompt mode loads, enter cd restore and press Enter.
• Then enter rstrui.exe and press Enter again.
• Click “Next” in the windows that appeared.
• Select one of the Restore Points that are available before Pluto Ransomware has infiltrated to your system and then click “Next”.
• To start System restore click “Yes”.

 

Step 2. Complete removal of Pluto Ransomware

After restoring your system, it is recommended to scan your computer with an anti-malware program, like Spyhunter and remove all malicious files related to Pluto Ransomware. You can check other tools here.  

Step 3. Restore Pluto Ransomware affected files using Shadow Volume Copies

If you do not use System Restore option on your operating system, there is a chance to use shadow copy snapshots. They store copies of your files that point of time when the system restore snapshot was created. Usually Pluto Ransomware tries to delete all possible Shadow Volume Copies, so this methods may not work on all computers. However, it may fail to do so. Shadow Volume Copies are only available with Windows XP Service Pack 2, Windows Vista, Windows 7, and Windows 8. There are two ways to retrieve your files via Shadow Volume Copy. You can do it using native Windows Previous Versions or via Shadow Explorer. a) Native Windows Previous Versions Right-click on an encrypted file and select Properties → Previous versions tab. Now you will see all available copies of that particular file and the time when it was stored in a Shadow Volume Copy. Choose the version of the file you want to retrieve and click Copy if you want to save it to some directory of your own, or Restore if you want to replace existing, encrypted file. If you want to see the content of file first, just click Open.

b) Shadow Explorer It is a program that can be found online for free. You can download either a full or a portable version of Shadow Explorer. Open the program. On the left top corner select the drive where the file you are looking for is a stored. You will see all folders on that drive. To retrieve a whole folder, right-click on it and select “Export”. Then choose where you want it to be stored.

Step 4. Use Data Recovery programs to recover Pluto Ransomware encrypted files

There are several data recovery programs that might recover encrypted files as well. This does not work in all cases but you can try this:

• We suggest using another PC and connect the infected hard drive as slave. It is still possible to do this on infected PC though.
• Download a data recovery program.
• Install and scan for recently deleted files.

Note: In many cases it is impossible to restore data files affected by modern ransomware. Thus I recommend using decent cloud backup software as precaution. We recommend checking out Carbonite, BackBlaze, CrashPlan or Mozy Home.