How to Terminate Arrow Ransomware (Crypto-Malware/Ransowmare)

What is Arrow ransomware? And how does it implement its attack?

Arrow ransomware is a new variant of the infamous Dharma ransomware. This new Dharma version uses the .arrow extension in marking the files it encrypts. As soon as it enters the system, Arrow ransomware will modify some Windows system files to gain administrative privileges. It also creates and alters some entries in the Windows Registry so it can run every time a user boots the computer.
It then implements its attack by scanning the computer for certain file types to target. According to researchers, just like the other versions of Dharma ransomware, Arrow ransomware targets files that have these extensions:
.PNG .PSD .PSPIMAGE .TGA .THM .TIF .TIFF .YUV .AI .EPS .PS .SVG .INDD .PCT .PDF .XLR .XLS .XLSX .ACCDB .DB .DBF .MDB .PDB .SQL .APK .APP .BAT .CGI .COM .EXE .GADGET .JAR .PIF .WSF .DEM .GAM .NES .ROM .SAV CAD Files .DWG .DXF GIS Files .GPX .KML .KMZ .ASP .ASPX .CER .CFM .CSR .CSS .HTM .HTML .JS .JSP .PHP .RSS .XHTML. DOC .DOCX .LOG .MSG .ODT .PAGES .RTF .TEX .TXT .WPD .WPS .CSV .DAT .GED .KEY .KEYCHAIN .PPS .PPT .PPTX ..INI .PRF Encoded Files .HQX .MIM .UUE .7Z .CBR .DEB .GZ .PKG .RAR .RPM .SITX .TAR.GZ .ZIP .ZIPX .BIN .CUE .DMG .ISO .MDF .TOAST .VCD SDF .TAR .TAX2014 .TAX2015 .VCF .XML Audio Files .AIF .IFF .M3U .M4A .MID .MP3 .MPA .WAV .WMA Video Files .3G2 .3GP .ASF .AVI .FLV .M4V .MOV .MP4 .MPG .RM .SRT .SWF .VOB .WMV 3D .3DM .3DS .MAX .OBJ R.BMP .DDS .GIF .JPG .CRX .PLUGIN .FNT .FON .OTF .TTF .CAB .CPL .CUR .DESKTHEMEPACK .DLL .DMP .DRV .ICNS .ICO .LNK .SYS .CFG
To make the data recovery almost impossible, Arrow ransomware also deletes the shadow volume copies of the affected files. After that, it opens its ransom note named “README.txt” that contains this message:
“ATTENTION!
AT THE MOMENT, YOUR SYSTEM IS NOT PROTECTED.
WE CAN FIX IT AND RESTORE FILES.
TO RESTORE THE SYSTEM WRITE TO THIS ADDRESS:
[email protected]”
Even though recovering the encrypted files of Arrow ransomware is next to impossible, contacting the crooks behind it to pay the ransom is still not recommended. More often than not, victims tend to be ignored by cybercriminals once they receive the payment. So it would only be a total waste of money and time. Since Arrow ransomware is still new, security experts have yet to develop a free decryptor for the victims of this cryptovirus.
How does Arrow ransomware proliferate?
Arrow ransomware proliferates in the same way as other variants of Dharma ransomware – via malicious spam emails. Malware-laden spam emails have the goal to deceive users into opening a malicious attachment carrying the Arrow ransomware. The attachment may be disguised as invoices, banking statements, receipts and other seemingly important files that could quickly catch a user’s attention.

Use the instructions laid out below to terminate Arrow ransomware from your system.
Step 1: Open the Task Manager simply by tapping Ctrl + Shift + Esc keys on your keyboard.
Step 2: Under the Task Manager, go to the Processes tab and look for info.hta and any suspicious-looking process which takes up most of your CPU’s resources and is most likely related to Arrow ransomware.

Step 3: After that, close the Task Manager.
Step 4: Tap Win + R, type in appwiz.cpl and click OK or tap Enter to open Control Panel’s list of installed programs.
Step 5: Under the list of installed programs, look for Arrow ransomware or anything similar and then uninstall it.

Step 6: Next, close Control Panel and tap Win + E keys to launch File Explorer.
Step 7: Go to the directories listed below and look for any malicious components like README.txt created by Arrow ransomware and delete them right away.

%TEMP%
%APPDATA%\Microsoft\Windows\Templates\
%USERPROFILE%\Downloads
%USERPROFILE%\Desktop

Step 8: Close the File Explorer.
Before you proceed to the next steps below, make sure that you are tech savvy enough to the point where you know exactly how to use and navigate your computer’s Registry. Keep in mind that any changes you make will highly impact your computer. To save you the trouble and time, you can just use PC Cleaner Pro, this system tool is proven to be safe and excellent enough that hackers won’t be able to hack into it. But if you can manage Windows Registry well, then, by all means, go on to the next steps.
Step 9: Tap Win + R to open Run and then type in regedit in the field and tap enter to pull up Windows Registry.

Step 10: Navigate to the following path:

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
HKCU\SOFTWARE
HKCU\SOFTWARE\WOW6432Node

Step 11: Delete the registry keys and sub-keys created by Arrowransomware.
Step 12: Close the Registry Editor and empty the Recycle Bin.
Following the removal guide above isn’t enough to ensure the removal of Arrow ransomware – you have to refer to the following advanced steps to complete the removal of Arrow ransomware.
Perform a full system scan using SpyRemover Pro. To do so, follow these steps:

Turn on your computer. If it’s already on, you have to reboot
After that, the BIOS screen will be displayed, but if Windows pops up instead, reboot your computer and try again. Once you’re on the BIOS screen, repeat pressing F8, by doing so the Advanced Option shows up.

To navigate the Advanced Option use the arrow keys and select Safe Mode with Networking then hit
Windows will now load the SafeMode with Networking.
Press and hold both R key and Windows key.

If done correctly, the Windows Run Box will show up.
Type in explorer http://www.fixmypcfree.com/install/spyremoverpro

A single space must be in between explorer and http. Click OK.

A dialog box will be displayed by Internet Explorer. Click Run to begin downloading the program. The installation will start automatically once a download is done.