CryptoWall Virus

Also Known As: CryptoWall 2.0 ransomware
Type: Ransomware
Damage level: Medium
Distribution: High
Damage Level

CryptoWall virus removal instructions

What is CryptoWall?

The CryptoWall ransomware virus infiltrates users' operating systems via infected email messages and fake downloads (for example, rogue video players or fake Flash updates). After successful infiltration, this malicious program encrypts files stored on users' computers (*.doc, *.docx, *.xls, *.ppt, *.psd, *.pdf, *.eps, *.ai, *.cdr, *.jpg, etc.) and demands payment of a $500 ransom (in Bitcoins) to decrypt them. Cyber criminals responsible for releasing this rogue program, ensure that it executes on all Windows versions (Windows XP, Windows Vista, Windows 7, and Windows 8). CryptoWall ransomware creates DECRYPT_INSTRUCTION.txt, DECRYPT_INSTRUCTION.html, and DECRYPT_INSTRUCTION.url files within each folder containing the encrypted files.

These files contain instructions detailing how users may decrypt their files, and on use of the Tor browser (an anonymous web browser). Cyber criminals use Tor to hide their identities. PC users should beware that while the infection itself is not complicated to remove, decryption of files (encrypted using RSA 2048 encryption) affected by this malicious program is impossible without paying the ransom. At time of research, there were no tools or solutions capable of decrypting files encrypted by CryptoWall. Note that the private key required to decrypt the files is stored by the CryptoWall command-and-control servers, which is managed by cyber criminals. Therefore, the ideal solution is to remove this ransomware virus and then restore your data from a backup.

Screenshot of a message presented within the DECRYPT_INSTRUCTION.txt, DECRYPT_INSTRUCTION.html and DECRYPT_INSTRUCTION.url files:

cryptowall decrypt instructions

Ransomware infections such as CryptoWall (including CryptoDefense, CryptorBit, and Cryptolocker) present a strong argument to maintain regular backups of your stored data. Note that paying the ransom as demanded by this ransomware is equivalent to sending your money to cyber criminals - you will support their malicious business model and there is no guarantee that your files will ever be decrypted. To avoid computer infection with ransomware infections such as this, express caution when opening email messages since cyber criminals use various catchy titles to trick PC users into opening infected email attachments (for example, "UPS Exception Notification"). Research shows that cyber criminals also use P2P networks and fake downloads, which contain bundled ransomware infections to proliferate CryptoWall.

Message presented in DECRYPT_INSTRUCTION.txt, DECRYPT_INSTRUCTION.html and DECRYPT_INSTRUCTION.url files:

What happened to your files?

 

All of your files were protected by a strong encryption with RSA-2048 using CryptoWall. More information about the encryption keys using RSA-2048 can be found here: en.wikipedia.org/wiki/RSA_(crypto system)

 

What does this mean?

 

This means that the structure and data within your files have been irrevocably changed, you will not be able to work with them, read them or see them, it is the same thing as losing them forever, but with our help, you can restore them.

 

How did this happen?

 

Especially for you, on our server was generated the secret key pair RSA-2048 - public and private. All your files were encrypted with the public key, which has been transferred to your computer via the Internet. Decrypting of your files is only possible with the help of the private key and decrypt program, which is on our secret server.

 

What do I do?

 

Alas, if you do not take the necessary measures for the specified time then the conditions for obtaining the private key will be changed. If you really value your data, then we suggest you do not waste valuable time searching for the solutions because they do not exist.

For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below:

 

1. hxxps://kpai7ycr7jxqkilp.torexplorer.com/3koe
2. hxxps://kpai7ycr7jxqkilp.tor2web.org/3koe
3. hxxps://kpai7ycr7jxqkilp.onion.to/3koe

 

If for some reasons the addresses are not available, follow these steps:

 

1. Download and install tor-browser: hxxp://www.torproject.org/projects/torbrowser.html.en
2. After a successful installation, run  the browser and wait for initialization.
3. Type in the address bar: kpai7ycr7jxqkilp.onion/3koe
4. Follow the instructions on the site.

Update 2014 October 2 - Cyber criminals have updated CryptoWall ransomware which is now known as CryptoWall 2.0 While the core elements of this ransomware is left unchanged cyber criminals have applied these updates:

  • Cyber criminals responsible for releasing CryptoWall 2.0 now uses their own Web-to-TOR gateways (pay2tor.com, tor2pay.com, pay4tor.com and tor4pay.com) - this allow them to stay hidden from authorities.
  • CryptoWall 2.0 creates a unique bitcoin payment address for each victim (original version used one bitcoin payment address for all compromised computers).
  • The new version deletes original data files - victims no longer can use data recovery tools to regain control of their encrypted files.

Screenshot of CryptoWall 2.0 ransomware:

cryptowall 2.0 ransomware

Screenshot of an infected email message used in CryptoWall distribution:

cryptowall distribution through UPS spam emails

Text presented in the infected email messages:

From: UPS Quantum View [auto-notify (at) ups.com]
Subject: UPS Exception Notification, Tracking Number 1Z522A9A6892487822

Discover more about UPS: Visit ups.com
At the request of the shipper, please be advised that delivery of the following shipment has been rescheduled.

Important Delivery Information

Tracking Number: 1Z522A9A6892487822
Rescheduled Delivery Date: 14-April-2014
Exception Reason: THE CUSTOMER WAS NOT AVAILABLE ON THE 1ST ATTEMPT. A 2ND ATTEMPT WILL BE MADE PACKAGE WILL BE DELIVERED NEXT BUSINESS DAY.
Shipment Detail: 1Z522A9A6892487822

Screenshot of a CryptoWall ransom payment page:

cryptowall website captcha protection

cryptowall decrypt page

 Message presented in the CryptoWall ransom payment page:

Decrypt service
Your files are encrypted.
To get the key to decrypt files you have to pay 500 USD/EUR. If payments is not made before [date] the cost of decrypting files will increase 2 times and will be 1000 USD/EUR Prior to increasing the amount left: [count down timer]

 

We are present a special software - CryptoWall Decrypter - which is allow to decrypt and return control to all your encrypted files. How to buy CryptoWall decrypter?

 

1. You should register Bitcoin waller
2. Purchasing Bitcoins - Although it's not yet easy to buy bit coins, it's getting simpler every day.
3. Send 1.22 BTC to Bitcoin address: 1BhLzCZGY6dwQYgX4B6NR5sjDebBPNapvv
4. Enter the Transaction ID and select amount.
5. Please check the payment information and click "PAY".

Note that at time of writing, there were no known tools capable of decrypting files encrypted by CryptoWall without paying the ransom. By following this removal guide, you will be able to remove this ransomware from your computer, however, the affected files will remain encrypted. We will update this article as soon as there is more information available regarding decryption of compromised files.

CryptoWall virus removal:

Quick menu:

Step 1

Windows XP and Windows 7 users: Start your computer in Safe Mode. Click Start, click Shut Down, click Restart, click OK. During your computer starting process press the F8 key on your keyboard multiple times until you see the Windows Advanced Option menu, then select Safe Mode with Networking from the list.

Safe Mode with Networking

Video showing how to start Windows 7 in "Safe Mode with Networking":

Windows 8 users: Start Windows 8 is Safe Mode with Networking - Go to Windows 8 Start Screen, type Advanced, in the search results select Settings. Click on Advanced startup options, in the opened "General PC Settings" window select Advanced startup. Click on "Restart now" button. Your computer will now restart into "Advanced Startup options menu". Click on the "Troubleshoot" button, then click on the "Advanced options" button. In the advanced option screen click on "Startup settings". Click on the "Restart" button. Your PC will restart into Startup Settings screen. Press F5 to boot in Safe Mode with Networking.

Windows 8 Safe Mode with networking

Video showing how to start Windows 8 in "Safe Mode with Networking":

Step 2

Log in to the account infected with the CryptoWall virus. Start your Internet browser and download a legitimate anti-spyware program. Update the anti-spyware software and start a full system scan. Remove all entries detected.

remover for CryptoWall ransomware virus

If you need assistance removing CryptoWall Virus, give us a call 24/7:
1-877-484-8393
By downloading any software listed on this website you agree to our Privacy Policy and Terms of Use. All the products we recommend were carefully tested and approved by our technicians as being one of the most effective solutions for removing this threat.


If you cannot start your computer in Safe Mode with Networking, try performing a System Restore.

Video showing how to remove ransomware virus using "Safe Mode with Command Prompt" and "System Restore":

1. During your computer starting process, press the F8 key on your keyboard multiple times until the Windows Advanced Options menu appears, and then select Safe Mode with Command Prompt from the list and press ENTER.

Boot your computer in Safe Mode with Command Prompt

2. When Command Prompt mode loads, enter the following line: cd restore and press ENTER.

system restore using command prompt type cd restore

3. Next, type this line: rstrui.exe and press ENTER.

system restore using command prompt rstrui.exe

4. In the opened window click "Next".

restore system files and settings

5. Select one of the available Restore Points and click "Next" (this will restore your computer system to an earlier time and date, prior to the CryptoWall ransomware virus infiltrating your PC).

select a restore point

6. In the opened window click "Yes".

run system restore

7. After restoring your computer to a previous date, download and scan your PC with recommended malware removal software to eliminate any remaining CryptoWall files.

To restore individual files encrypted by this ransomware, try using Windows Previous Versions feature. This method is only effective if the System Restore function was enabled on an infected operating system. Note that some variants of CryptoWall are known to remove Shadow Volume Copies of the files, so this method may not work on all computers.

To restore a file, right-click on it, go into Properties, and select the Previous Versions tab. If the relevant file has a Restore Point, select it and click the "Restore" button.

Restoring files encrypted by CryptoDefense

If you cannot start your computer in Safe Mode with Networking (or with Command Prompt),boot your computer using a rescue disk. Some variants of ransomware disable Safe Mode making its removal complicated. For this step, you require access to another computer.

To regain control of the files encrypted by CryptoWall you can also try using a program called Shadow Explorer. More information on how to use this program is available here.

shadow explorer screenshot

To protect your computer from such file encrypting ransomware you should use reputable antivirus and anti-spyware programs. As an extra protection method computer users can use a program called CryptoPrevent. (CryptoPrevent artificially implants group policy objects into the registry in order to block rogue programs such as CryptoWall.)

cryptoprevent screenshot

Other tools known to remove CryptoWall ransomware:

About the author:

I am passionate about computer security and technology. I have an experience of 10 years working in various companies related to computer technical issue solving and Internet security. I have been working as an editor for pcrisk.com since 2010.

Follow me on Google+ to stay informed about the latest online security threats.

Our malware removal guides are free. However, if you want to support us you can send us a donation.