FacebookTwitterLinkedIn

CryptoWall Virus

Also Known As: Help_Recover_Instructions virus
Damage level: Severe

What is CryptoWall?

The CryptoWall ransomware virus infiltrates users' operating systems via infected email messages and fake downloads (for example, rogue video players or fake Flash updates). After successful infiltration, this malicious program encrypts files stored on users' computers (*.doc, *.docx, *.xls, *.ppt, *.psd, *.pdf, *.eps, *.ai, *.cdr, *.jpg, etc.) and demands payment of a $500 ransom (in Bitcoins) to decrypt them.

Cyber criminals responsible for releasing this rogue program, ensure that it executes on all Windows versions (Windows XP, Windows Vista, Windows 7, and Windows 8). CryptoWall ransomware creates HELP_RECOVER_INSTRUCTIONS.PNG, HELP_RECOVER_INSTRUCTIONS.HTML and HELP_RECOVER_INSTRUCTIONS.TXT files within each folder containing the encrypted files.

These files contain instructions detailing how users may decrypt their files, and on use of the Tor browser (an anonymous web browser). Cyber criminals use Tor to hide their identities.

PC users should beware that while the infection itself is not complicated to remove, decryption of files (encrypted using RSA 2048 encryption) affected by this malicious program is impossible without paying the ransom. At time of research, there were no tools or solutions capable of decrypting files encrypted by CryptoWall.

Note that the private key required to decrypt the files is stored by the CryptoWall command-and-control servers, which is managed by cyber criminals. Therefore, the ideal solution is to remove this ransomware virus and then restore your data from a backup.

CryptoWall ransomware attacking victim's computer:

cryptowall infected pc sample

Screenshot of a message presented within the HELP_RECOVER_INSTRUCTIONS.PNG, HELP_RECOVER_INSTRUCTIONS.HTML and HELP_RECOVER_INSTRUCTIONS.TXT files:

cryptowall decrypt instructions

CryptoWall 3.0 HELP_DECRYPT.PNG, HELP_DECRYPT.HTML and HELP_DECRYPT.TXT screenshots:

cryptowall 3.0 main screen cryptowall 3.0 help decrypt html file cryptowall 3.0 help decrypt png file cryptowall 3.0 help decrypt txt file

Ransomware infections such as CryptoWall (including CryptoDefense, CryptorBit, and Cryptolocker) present a strong argument to maintain regular backups of your stored data.

Note that paying the ransom as demanded by this ransomware is equivalent to sending your money to cyber criminals - you will support their malicious business model and there is no guarantee that your files will ever be decrypted.

To avoid computer infection with ransomware infections such as this, express caution when opening email messages since cyber criminals use various catchy titles to trick PC users into opening infected email attachments (for example, "UPS Exception Notification").

Research shows that cyber criminals also use P2P networks and fake downloads, which contain bundled ransomware infections to proliferate CryptoWall.

Message presented in HELP_RECOVER_INSTRUCTIONS.PNG, HELP_RECOVER_INSTRUCTIONS.HTML and HELP_RECOVER_INSTRUCTIONS.TXT files:

What happened to your files ?
All of your files were protected by a strong encryption with RSA-2048 using CryptoWall 3.0. More information about the encryption keys using RSA-2048 can be found here: http://en.wikipedia.org/wiki/RSA_(cryptosystem)

What does this mean ?
This means that the structure and data within your files have been irrevocably changed, you will not be able to work with them, read them or see them, it is the same thing as losing them forever, but with our help, you can restore them.

How did this happen ?
Especially for you, on our server was generated the secret key pair RSA-2048 - public and private. All your files were encrypted with the public key, which has been transferred to your computer via the Internet. Decrypting of your files is only possible with the help of the private key and decrypt program, which is on our secret server.

What do I do ?
Alas, if you do not take the necessary measures for the specified time then the conditions for obtaining the private key will be changed. If you really value your data, then we suggest you do not waste valuable time searching for other solutions because they do not exist.

For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below:

 

1. hxxps://kpai7ycr7jxqkilp.torexplorer.com/3koe
2. hxxps://kpai7ycr7jxqkilp.tor2web.org/3koe
3. hxxps://kpai7ycr7jxqkilp.onion.to/3koe

 

If for some reasons the addresses are not available, follow these steps:

 

1. Download and install tor-browser: hxxp://www.torproject.org/projects/torbrowser.html.en
2. After a successful installation, run  the browser and wait for initialization.
3. Type in the address bar: kpai7ycr7jxqkilp.onion/3koe
4. Follow the instructions on the site.

Update 2014 October 2 - Cyber criminals have updated CryptoWall ransomware which is now known as CryptoWall 2.0 While the core elements of this ransomware is left unchanged cyber criminals have applied these updates:

  • Cyber criminals responsible for releasing CryptoWall 2.0 now uses their own Web-to-TOR gateways (pay2tor.com, tor2pay.com, pay4tor.com and tor4pay.com) - this allow them to stay hidden from authorities.
  • CryptoWall 2.0 creates a unique bitcoin payment address for each victim (original version used one bitcoin payment address for all compromised computers).
  • The new version deletes original data files - victims no longer can use data recovery tools to regain control of their encrypted files.

Screenshot of CryptoWall 2.0 ransomware:

cryptowall 2.0 ransomware

Update 2015 August 6 - Cyber criminals have released another variant of this ransomware - CryptoWall 3.0 (hides C&C Communications with I2P Anonymity Network - creates HELP_DECRYPT.PNG, HELP_DECRYPT.HTML and HELP_DECRYPT.TXT files within each folder containing the encrypted files).

The new variant appends .aaa after the original files names and extensions that are encrypted by this ransomware, for example familyphoto.jpg.aaa Decryption and ransom payment instructions are now stored in restore_files_[random letter].html and restore_files_[random letter].txt files:

cryptowall 3.0 ransomware (help_decrypt virus)

Update 2015 November 5 - Cyber criminals have released another variant of this ransomware - CryptoWall 4.0 The new variant acts the same as it's previous versions, the changes comparing to the CryptoWall 3 ransomware include: changed ransom demanding message; the encrypted files on victims computer now get unique encrypted names (for example: 8354no9f.7gt8);

the ransom of 500$ is now increased to 700$; the files in which victims can find the instructions on how to pay the ransom are now stored in HELP_YOUR_FILES.HTML, HELP_YOUR_FILES.TXT and HELP_YOUR_FILES.PNG files. Unfortunately at the time of writing this message no tools were available to decrypt the compromised files without paying the ransom.

Screenshot of Cryptowall 4.0 ransomware:

cryptowall 4.0 ransomware

Screenshot of an infected email message used in CryptoWall distribution:

cryptowall distribution through UPS spam emails

Text presented in the infected email messages:

From: UPS Quantum View [auto-notify (at) ups.com]
Subject: UPS Exception Notification, Tracking Number 1Z522A9A6892487822

Discover more about UPS: Visit ups.com
At the request of the shipper, please be advised that delivery of the following shipment has been rescheduled.

Important Delivery Information

Tracking Number: 1Z522A9A6892487822
Rescheduled Delivery Date: 14-April-2014
Exception Reason: THE CUSTOMER WAS NOT AVAILABLE ON THE 1ST ATTEMPT. A 2ND ATTEMPT WILL BE MADE PACKAGE WILL BE DELIVERED NEXT BUSINESS DAY.
Shipment Detail: 1Z522A9A6892487822

Screenshot of a CryptoWall ransom payment page:

cryptowall website captcha protection

cryptowall decrypt page

 Message presented in the CryptoWall ransom payment page:

Decrypt service
Your files are encrypted.
To get the key to decrypt files you have to pay 500 USD/EUR. If payments is not made before [date] the cost of decrypting files will increase 2 times and will be 1000 USD/EUR Prior to increasing the amount left: [count down timer]

 

We are present a special software - CryptoWall Decrypter - which is allow to decrypt and return control to all your encrypted files. How to buy CryptoWall decrypter?

 

1. You should register Bitcoin waller
2. Purchasing Bitcoins - Although it's not yet easy to buy bit coins, it's getting simpler every day.
3. Send 1.22 BTC to Bitcoin address: 1BhLzCZGY6dwQYgX4B6NR5sjDebBPNapvv
4. Enter the Transaction ID and select amount.
5. Please check the payment information and click "PAY".

Note that at time of writing, there were no known tools capable of decrypting files encrypted by CryptoWall without paying the ransom.

By following this removal guide, you will be able to remove this ransomware from your computer, however, the affected files will remain encrypted. We will update this article as soon as there is more information available regarding decryption of compromised files.

CryptoWall virus removal:

Instant automatic malware removal: Manual threat removal might be a lengthy and complicated process that requires advanced IT skills. Combo Cleaner is a professional automatic malware removal tool that is recommended to get rid of malware. Download it by clicking the button below:
▼ DOWNLOAD Combo Cleaner By downloading any software listed on this website you agree to our Privacy Policy and Terms of Use. To use full-featured product, you have to purchase a license for Combo Cleaner. 7 days free trial available. Combo Cleaner is owned and operated by Rcs Lt, the parent company of PCRisk.com read more.

Quick menu:

Step 1

Windows XP and Windows 7 users: Start your computer in Safe Mode. Click Start, click Shut Down, click Restart, click OK. During your computer starting process press the F8 key on your keyboard multiple times until you see the Windows Advanced Option menu, then select Safe Mode with Networking from the list.

Safe Mode with Networking

Video showing how to start Windows 7 in "Safe Mode with Networking":

Windows 8 users: Start Windows 8 is Safe Mode with Networking - Go to Windows 8 Start Screen, type Advanced, in the search results select Settings. Click on Advanced startup options, in the opened "General PC Settings" window select Advanced startup. Click on "Restart now" button.

Your computer will now restart into "Advanced Startup options menu". Click on the "Troubleshoot" button, then click on the "Advanced options" button. In the advanced option screen click on "Startup settings". Click on the "Restart" button. Your PC will restart into Startup Settings screen. Press F5 to boot in Safe Mode with Networking.

Windows 8 Safe Mode with networking

Video showing how to start Windows 8 in "Safe Mode with Networking":

Windows 10 users: Click the Windows logo and select the Power icon. In the opened menu click "Restart" while holding "Shift" button on your keyboard. In the "choose an option" window click on the "Troubleshoot", next select "Advanced options". In the advanced options menu select "Startup Settings" and click on the "Restart" button.

In the following window you should click the "F5" button on your keyboard. This will restart your operating system in safe mode with networking.

windows 10 safe mode with networking

Video showing how to start Windows 10 in "Safe Mode with Networking":

Windows 10 users: Click the Windows logo and select the Power icon. In the opened menu click "Restart" while holding "Shift" button on your keyboard. In the "choose an option" window click on the "Troubleshoot", next select "Advanced options". In the advanced options menu select "Startup Settings" and click on the "Restart" button.

In the following window you should click the "F5" button on your keyboard. This will restart your operating system in safe mode with networking.

windows 10 safe mode with networking

Video showing how to start Windows 10 in "Safe Mode with Networking":

Step 2

Log in to the account infected with the CryptoWall virus. Start your Internet browser and download a legitimate anti-spyware program. Update the anti-spyware software and start a full system scan. Remove all entries detected.


If you cannot start your computer in Safe Mode with Networking, try performing a System Restore.

Video showing how to remove ransomware virus using "Safe Mode with Command Prompt" and "System Restore":

1. During your computer starting process, press the F8 key on your keyboard multiple times until the Windows Advanced Options menu appears, and then select Safe Mode with Command Prompt from the list and press ENTER.

Boot your computer in Safe Mode with Command Prompt

2. When Command Prompt mode loads, enter the following line: cd restore and press ENTER.

system restore using command prompt type cd restore

3. Next, type this line: rstrui.exe and press ENTER.

system restore using command prompt rstrui.exe

4. In the opened window click "Next".

restore system files and settings

5. Select one of the available Restore Points and click "Next" (this will restore your computer system to an earlier time and date, prior to the CryptoWall ransomware virus infiltrating your PC).

select a restore point

6. In the opened window click "Yes".

run system restore

7. After restoring your computer to a previous date, download and scan your PC with recommended malware removal software to eliminate any remaining CryptoWall files.

To restore individual files encrypted by this ransomware, try using Windows Previous Versions feature. This method is only effective if the System Restore function was enabled on an infected operating system. Note that some variants of CryptoWall are known to remove Shadow Volume Copies of the files, so this method may not work on all computers.

To restore a file, right-click on it, go into Properties, and select the Previous Versions tab. If the relevant file has a Restore Point, select it and click the "Restore" button.

Restoring files encrypted by CryptoDefense

If you cannot start your computer in Safe Mode with Networking (or with Command Prompt),boot your computer using a rescue disk. Some variants of ransomware disable Safe Mode making its removal complicated. For this step, you require access to another computer.

To regain control of the files encrypted by CryptoWall you can also try using a program called Shadow Explorer. More information on how to use this program is available here.

shadow explorer screenshot

 To protect your computer from file encrypting ransomware such as this, use reputable antivirus and anti-spyware programs. As an extra protection method, you can use programs called HitmanPro.Alert and Malwarebytes Anti-Ransomware, which artificially implant group policy objects into the registry to block rogue programs such as CryptoWall.)

HitmanPro.Alert CryptoGuard - detects encryption of files and neutralises such attempts without need for user intervention:

hitmanproalert ransomware prevention application

Malwarebytes Anti-Ransomware Beta uses advanced proactive technology that monitors ransomware activity and terminates it immediately - before reaching users' files:

malwarebytes anti-ransomware

  • The best way to avoid damage from ransomware infections is to maintain regular up-to-date backups. More information on online backup solutions and data recovery software Here.

Other tools known to remove CryptoWall ransomware:

▼ Show Discussion

About the author:

Tomas Meskauskas

Tomas Meskauskas - expert security researcher, professional malware analyst.

I am passionate about computer security and technology. I have an experience of over 10 years working in various companies related to computer technical issue solving and Internet security. I have been working as an author and editor for pcrisk.com since 2010. Follow me on Twitter and LinkedIn to stay informed about the latest online security threats. Contact Tomas Meskauskas.

PCrisk security portal is brought by a company RCS LT. Joined forces of security researchers help educate computer users about the latest online security threats. More information about the company RCS LT.

Our malware removal guides are free. However, if you want to support us you can send us a donation.

About PCrisk

PCrisk is a cyber security portal, informing Internet users about the latest digital threats. Our content is provided by security experts and professional malware researchers. Read more about us.

Malware activity

Global malware activity level today:

Medium threat activity

Increased attack rate of infections detected within the last 24 hours.

QR Code
Help_Recover_Instructions virus QR code
Scan this QR code to have an easy access removal guide of Help_Recover_Instructions virus on your mobile device.
We Recommend:

Get rid of Windows malware infections today:

▼ REMOVE IT NOW
Download Combo Cleaner

Platform: Windows

Editors' Rating for Combo Cleaner:
Editors ratingOutstanding!

[Back to Top]

To use full-featured product, you have to purchase a license for Combo Cleaner. 7 days free trial available. Combo Cleaner is owned and operated by Rcs Lt, the parent company of PCRisk.com read more.