Malware researchers have spotted the Argus Ransomware in the second week of November 2018, and unfortunately, it has already managed to infect a small number of users in different countries. When this ransomware initiates its attack, it will leave all the locked files with the ‘.ARGUS’ extension added to their names. The Argus Ransomware also may execute a broad range of additional tasks whose purpose is to provide the victim with file decryption instructions, as well as make the free recovery of their files a more challenging task. The Argus Ransomware will:

• Use Windows commands to disable the System Restore and delete the Shadow Volume Copies.
• Replace the default desktop background with the file ‘wallpaper.bmp,’ which also is brought by the ransomware.
• Leave the ransom note ‘ARGUS-DECRYPT.html’ on the desktop.

The ransom note provided by the Argus Ransomware’s authors reveals that the attackers are not willing to help out for free, and they demand to receive a ransom payment in exchange for their decryptor. They ask to be contacted by using the addresses [email protected] and [email protected], and they also provide the victim with a reserve contact option in case they do not get a reply – the TOR-based page hxxp://argusqug6aw25gye.onion.

If your machine has been attacked by the Argus Ransomware and it is too late to save your files, then we suggest that you disregard the instructions of the attackers. Despite their promises to provide you with your files when the payment is complete, there is a great chance that they might end up taking your money and giving you nothing in return. Many ransomware victims have been tricked in the past, and it would not be a surprise if the Argus Ransomware’s authors have the same plan.

Instead of negotiating with cybercriminals, you should use a reliable anti-virus tool to get rid of the Argus Ransomware’s files immediately. Once this is done, you may want to try alternative data recovery software and methods, since they may sometimes be able to undo some of the damage caused by threats like the Argus Ransomware.
[template:aliases][template:removal][template:technical_title][template:files][template:registry][template:additional]