Written by Tomas Meskauskas
Damage level: Medium
CryptoWall virus removal instructions
What is CryptoWall?
The CryptoWall ransomware virus infiltrates users' operating systems via infected email messages and fake downloads (for example, rogue video players or fake Flash updates). After successful infiltration, this malicious program encrypts files stored on users' computers (*.doc, *.docx, *.xls, *.ppt, *.psd, *.pdf, *.eps, *.ai, *.cdr, *.jpg, etc.) and demands payment of a $500 ransom (in Bitcoins) to decrypt them. Cyber criminals responsible for releasing this rogue program, ensure that it executes on all Windows versions (Windows XP, Windows Vista, Windows 7, and Windows 8). CryptoWall ransomware creates DECRYPT_INSTRUCTION.txt, DECRYPT_INSTRUCTION.html, and DECRYPT_INSTRUCTION.url files within each folder containing the encrypted files.
These files contain instructions detailing how users may decrypt their files, and on use of the Tor browser (an anonymous web browser). Cyber criminals use Tor to hide their identities. PC users should beware that while the infection itself is not complicated to remove, decryption of files (encrypted using RSA 2048 encryption) affected by this malicious program is impossible without paying the ransom. At time of research, there were no tools or solutions capable of decrypting files encrypted by CryptoWall. Note that the private key required to decrypt the files is stored by the CryptoWall command-and-control servers, which is managed by cyber criminals. Therefore, the ideal solution is to remove this ransomware virus and then restore your data from a backup.
Screenshot of a message presented within the DECRYPT_INSTRUCTION.txt, DECRYPT_INSTRUCTION.html and DECRYPT_INSTRUCTION.url files:
Ransomware infections such as CryptoWall (including CryptoDefense, CryptorBit, and Cryptolocker) present a strong argument to maintain regular backups of your stored data. Note that paying the ransom as demanded by this ransomware is equivalent to sending your money to cyber criminals - you will support their malicious business model and there is no guarantee that your files will ever be decrypted. To avoid computer infection with ransomware infections such as this, express caution when opening email messages since cyber criminals use various catchy titles to trick PC users into opening infected email attachments (for example, "UPS Exception Notification"). Research shows that cyber criminals also use P2P networks and fake downloads, which contain bundled ransomware infections to proliferate CryptoWall.
Message presented in DECRYPT_INSTRUCTION.txt, DECRYPT_INSTRUCTION.html and DECRYPT_INSTRUCTION.url files:
What happened to your files?
All of your files were protected by a strong encryption with RSA-2048 using CryptoWall. More information about the encryption keys using RSA-2048 can be found here: en.wikipedia.org/wiki/RSA_(crypto system)
What does this mean?
This means that the structure and data within your files have been irrevocably changed, you will not be able to work with them, read them or see them, it is the same thing as losing them forever, but with our help, you can restore them.
How did this happen?
Especially for you, on our server was generated the secret key pair RSA-2048 - public and private. All your files were encrypted with the public key, which has been transferred to your computer via the Internet. Decrypting of your files is only possible with the help of the private key and decrypt program, which is on our secret server.
What do I do?
Alas, if you do not take the necessary measures for the specified time then the conditions for obtaining the private key will be changed. If you really value your data, then we suggest you do not waste valuable time searching for the solutions because they do not exist.
For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below:
If for some reasons the addresses are not available, follow these steps:
1. Download and install tor-browser: hxxp://www.torproject.org/projects/torbrowser.html.en
2. After a successful installation, run the browser and wait for initialization.
3. Type in the address bar: kpai7ycr7jxqkilp.onion/3koe
4. Follow the instructions on the site.
Update 2014 October 2 - Cyber criminals have updated CryptoWall ransomware which is now known as CryptoWall 2.0 While the core elements of this ransomware is left unchanged cyber criminals have applied these updates:
- Cyber criminals responsible for releasing CryptoWall 2.0 now uses their own Web-to-TOR gateways (pay2tor.com, tor2pay.com, pay4tor.com and tor4pay.com) - this allow them to stay hidden from authorities.
- CryptoWall 2.0 creates a unique bitcoin payment address for each victim (original version used one bitcoin payment address for all compromised computers).
- The new version deletes original data files - victims no longer can use data recovery tools to regain control of their encrypted files.
Screenshot of CryptoWall 2.0 ransomware:
Screenshot of an infected email message used in CryptoWall distribution:
Text presented in the infected email messages:
From: UPS Quantum View [auto-notify (at) ups.com]
Subject: UPS Exception Notification, Tracking Number 1Z522A9A6892487822
Discover more about UPS: Visit ups.com
At the request of the shipper, please be advised that delivery of the following shipment has been rescheduled.
Important Delivery Information
Tracking Number: 1Z522A9A6892487822
Rescheduled Delivery Date: 14-April-2014
Exception Reason: THE CUSTOMER WAS NOT AVAILABLE ON THE 1ST ATTEMPT. A 2ND ATTEMPT WILL BE MADE PACKAGE WILL BE DELIVERED NEXT BUSINESS DAY.
Shipment Detail: 1Z522A9A6892487822
Screenshot of a CryptoWall ransom payment page:
Message presented in the CryptoWall ransom payment page:
Your files are encrypted.
To get the key to decrypt files you have to pay 500 USD/EUR. If payments is not made before [date] the cost of decrypting files will increase 2 times and will be 1000 USD/EUR Prior to increasing the amount left: [count down timer]
We are present a special software - CryptoWall Decrypter - which is allow to decrypt and return control to all your encrypted files. How to buy CryptoWall decrypter?
1. You should register Bitcoin waller
2. Purchasing Bitcoins - Although it's not yet easy to buy bit coins, it's getting simpler every day.
3. Send 1.22 BTC to Bitcoin address: 1BhLzCZGY6dwQYgX4B6NR5sjDebBPNapvv
4. Enter the Transaction ID and select amount.
5. Please check the payment information and click "PAY".
Note that at time of writing, there were no known tools capable of decrypting files encrypted by CryptoWall without paying the ransom. By following this removal guide, you will be able to remove this ransomware from your computer, however, the affected files will remain encrypted. We will update this article as soon as there is more information available regarding decryption of compromised files.
CryptoWall virus removal:
- What is CryptoWall?
- STEP 1. CryptoWall virus removal using safe mode with networking.
- STEP 2. CryptoWall ransomware removal using System Restore.
Windows XP and Windows 7 users: Start your computer in Safe Mode. Click Start, click Shut Down, click Restart, click OK. During your computer starting process press the F8 key on your keyboard multiple times until you see the Windows Advanced Option menu, then select Safe Mode with Networking from the list.
Video showing how to start Windows 7 in "Safe Mode with Networking":
Windows 8 users: Start Windows 8 is Safe Mode with Networking - Go to Windows 8 Start Screen, type Advanced, in the search results select Settings. Click on Advanced startup options, in the opened "General PC Settings" window select Advanced startup. Click on "Restart now" button. Your computer will now restart into "Advanced Startup options menu". Click on the "Troubleshoot" button, then click on the "Advanced options" button. In the advanced option screen click on "Startup settings". Click on the "Restart" button. Your PC will restart into Startup Settings screen. Press F5 to boot in Safe Mode with Networking.
Video showing how to start Windows 8 in "Safe Mode with Networking":
Log in to the account infected with the CryptoWall virus. Start your Internet browser and download a legitimate anti-spyware program. Update the anti-spyware software and start a full system scan. Remove all entries detected.
If you cannot start your computer in Safe Mode with Networking, try performing a System Restore.
Video showing how to remove ransomware virus using "Safe Mode with Command Prompt" and "System Restore":
1. During your computer starting process, press the F8 key on your keyboard multiple times until the Windows Advanced Options menu appears, and then select Safe Mode with Command Prompt from the list and press ENTER.
2. When Command Prompt mode loads, enter the following line: cd restore and press ENTER.
3. Next, type this line: rstrui.exe and press ENTER.
4. In the opened window click "Next".
5. Select one of the available Restore Points and click "Next" (this will restore your computer system to an earlier time and date, prior to the CryptoWall ransomware virus infiltrating your PC).
6. In the opened window click "Yes".
7. After restoring your computer to a previous date, download and scan your PC with recommended malware removal software to eliminate any remaining CryptoWall files.
To restore individual files encrypted by this ransomware, try using Windows Previous Versions feature. This method is only effective if the System Restore function was enabled on an infected operating system. Note that some variants of CryptoWall are known to remove Shadow Volume Copies of the files, so this method may not work on all computers.
To restore a file, right-click on it, go into Properties, and select the Previous Versions tab. If the relevant file has a Restore Point, select it and click the "Restore" button.
If you cannot start your computer in Safe Mode with Networking (or with Command Prompt),boot your computer using a rescue disk. Some variants of ransomware disable Safe Mode making its removal complicated. For this step, you require access to another computer.
Other tools known to remove CryptoWall ransomware: