CryptoWall Virus

Also Known As: Help_Recover_Instructions virus
Distribution: Low
Damage level: Severe

CryptoWall virus removal instructions

What is CryptoWall?

The CryptoWall ransomware virus infiltrates users' operating systems via infected email messages and fake downloads (for example, rogue video players or fake Flash updates). After successful infiltration, this malicious program encrypts files stored on users' computers (*.doc, *.docx, *.xls, *.ppt, *.psd, *.pdf, *.eps, *.ai, *.cdr, *.jpg, etc.) and demands payment of a $500 ransom (in Bitcoins) to decrypt them. Cyber criminals responsible for releasing this rogue program, ensure that it executes on all Windows versions (Windows XP, Windows Vista, Windows 7, and Windows 8). CryptoWall ransomware creates HELP_RECOVER_INSTRUCTIONS.PNG, HELP_RECOVER_INSTRUCTIONS.HTML and HELP_RECOVER_INSTRUCTIONS.TXT files within each folder containing the encrypted files.

These files contain instructions detailing how users may decrypt their files, and on use of the Tor browser (an anonymous web browser). Cyber criminals use Tor to hide their identities. PC users should beware that while the infection itself is not complicated to remove, decryption of files (encrypted using RSA 2048 encryption) affected by this malicious program is impossible without paying the ransom. At time of research, there were no tools or solutions capable of decrypting files encrypted by CryptoWall. Note that the private key required to decrypt the files is stored by the CryptoWall command-and-control servers, which is managed by cyber criminals. Therefore, the ideal solution is to remove this ransomware virus and then restore your data from a backup.

CryptoWall ransomware attacking victim's computer:

cryptowall infected pc sample


cryptowall decrypt instructions


cryptowall 3.0 main screen cryptowall 3.0 help decrypt html file cryptowall 3.0 help decrypt png file cryptowall 3.0 help decrypt txt file

Ransomware infections such as CryptoWall (including CryptoDefense, CryptorBit, and Cryptolocker) present a strong argument to maintain regular backups of your stored data. Note that paying the ransom as demanded by this ransomware is equivalent to sending your money to cyber criminals - you will support their malicious business model and there is no guarantee that your files will ever be decrypted. To avoid computer infection with ransomware infections such as this, express caution when opening email messages since cyber criminals use various catchy titles to trick PC users into opening infected email attachments (for example, "UPS Exception Notification"). Research shows that cyber criminals also use P2P networks and fake downloads, which contain bundled ransomware infections to proliferate CryptoWall.


What happened to your files ?
All of your files were protected by a strong encryption with RSA-2048 using CryptoWall 3.0. More information about the encryption keys using RSA-2048 can be found here:

What does this mean ?
This means that the structure and data within your files have been irrevocably changed, you will not be able to work with them, read them or see them, it is the same thing as losing them forever, but with our help, you can restore them.

How did this happen ?
Especially for you, on our server was generated the secret key pair RSA-2048 - public and private. All your files were encrypted with the public key, which has been transferred to your computer via the Internet. Decrypting of your files is only possible with the help of the private key and decrypt program, which is on our secret server.

What do I do ?
Alas, if you do not take the necessary measures for the specified time then the conditions for obtaining the private key will be changed. If you really value your data, then we suggest you do not waste valuable time searching for other solutions because they do not exist.

For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below:


1. hxxps://
2. hxxps://
3. hxxps://


If for some reasons the addresses are not available, follow these steps:


1. Download and install tor-browser: hxxp://
2. After a successful installation, run  the browser and wait for initialization.
3. Type in the address bar: kpai7ycr7jxqkilp.onion/3koe
4. Follow the instructions on the site.

Update 2014 October 2 - Cyber criminals have updated CryptoWall ransomware which is now known as CryptoWall 2.0 While the core elements of this ransomware is left unchanged cyber criminals have applied these updates:

  • Cyber criminals responsible for releasing CryptoWall 2.0 now uses their own Web-to-TOR gateways (,, and - this allow them to stay hidden from authorities.
  • CryptoWall 2.0 creates a unique bitcoin payment address for each victim (original version used one bitcoin payment address for all compromised computers).
  • The new version deletes original data files - victims no longer can use data recovery tools to regain control of their encrypted files.

Screenshot of CryptoWall 2.0 ransomware:

cryptowall 2.0 ransomware

Update 2015 August 6 - Cyber criminals have released another variant of this ransomware - CryptoWall 3.0 (hides C&C Communications with I2P Anonymity Network - creates HELP_DECRYPT.PNG, HELP_DECRYPT.HTML and HELP_DECRYPT.TXT files within each folder containing the encrypted files). The new variant appends .aaa after the original files names and extensions that are encrypted by this ransomware, for example Decryption and ransom payment instructions are now stored in restore_files_[random letter].html and restore_files_[random letter].txt files:

cryptowall 3.0 ransomware (help_decrypt virus)

Update 2015 November 5 - Cyber criminals have released another variant of this ransomware - CryptoWall 4.0 The new variant acts the same as it's previous versions, the changes comparing to the CryptoWall 3 ransomware include: changed ransom demanding message; the encrypted files on victims computer now get unique encrypted names (for example: 8354no9f.7gt8); the ransom of 500$ is now increased to 700$; the files in which victims can find the instructions on how to pay the ransom are now stored in HELP_YOUR_FILES.HTML, HELP_YOUR_FILES.TXT and HELP_YOUR_FILES.PNG files. Unfortunately at the time of writing this message no tools were available to decrypt the compromised files without paying the ransom.

Screenshot of Cryptowall 4.0 ransomware:

cryptowall 4.0 ransomware

Screenshot of an infected email message used in CryptoWall distribution:

cryptowall distribution through UPS spam emails

Text presented in the infected email messages:

From: UPS Quantum View [auto-notify (at)]
Subject: UPS Exception Notification, Tracking Number 1Z522A9A6892487822

Discover more about UPS: Visit
At the request of the shipper, please be advised that delivery of the following shipment has been rescheduled.

Important Delivery Information

Tracking Number: 1Z522A9A6892487822
Rescheduled Delivery Date: 14-April-2014
Shipment Detail: 1Z522A9A6892487822

Screenshot of a CryptoWall ransom payment page:

cryptowall website captcha protection

cryptowall decrypt page

 Message presented in the CryptoWall ransom payment page:

Decrypt service
Your files are encrypted.
To get the key to decrypt files you have to pay 500 USD/EUR. If payments is not made before [date] the cost of decrypting files will increase 2 times and will be 1000 USD/EUR Prior to increasing the amount left: [count down timer]


We are present a special software - CryptoWall Decrypter - which is allow to decrypt and return control to all your encrypted files. How to buy CryptoWall decrypter?


1. You should register Bitcoin waller
2. Purchasing Bitcoins - Although it's not yet easy to buy bit coins, it's getting simpler every day.
3. Send 1.22 BTC to Bitcoin address: 1BhLzCZGY6dwQYgX4B6NR5sjDebBPNapvv
4. Enter the Transaction ID and select amount.
5. Please check the payment information and click "PAY".

Note that at time of writing, there were no known tools capable of decrypting files encrypted by CryptoWall without paying the ransom. By following this removal guide, you will be able to remove this ransomware from your computer, however, the affected files will remain encrypted. We will update this article as soon as there is more information available regarding decryption of compromised files.

CryptoWall virus removal:

Instant automatic malware removal: Manual threat removal might be a lengthy and complicated process that requires advanced computer skills. Malwarebytes is a professional automatic malware removal tool that is recommended to get rid of malware. Download it by clicking the button below:
▼ DOWNLOAD Malwarebytes By downloading any software listed on this website you agree to our Privacy Policy and Terms of Use. To use full-featured product, you have to purchase a license for Malwarebytes. 14 days free trial available.

Quick menu:

Step 1

Windows XP and Windows 7 users: Start your computer in Safe Mode. Click Start, click Shut Down, click Restart, click OK. During your computer starting process press the F8 key on your keyboard multiple times until you see the Windows Advanced Option menu, then select Safe Mode with Networking from the list.

Safe Mode with Networking

Video showing how to start Windows 7 in "Safe Mode with Networking":

Windows 8 users: Start Windows 8 is Safe Mode with Networking - Go to Windows 8 Start Screen, type Advanced, in the search results select Settings. Click on Advanced startup options, in the opened "General PC Settings" window select Advanced startup. Click on "Restart now" button. Your computer will now restart into "Advanced Startup options menu". Click on the "Troubleshoot" button, then click on the "Advanced options" button. In the advanced option screen click on "Startup settings". Click on the "Restart" button. Your PC will restart into Startup Settings screen. Press F5 to boot in Safe Mode with Networking.

Windows 8 Safe Mode with networking

Video showing how to start Windows 8 in "Safe Mode with Networking":

Windows 10 users: Click the Windows logo and select the Power icon. In the opened menu click "Restart" while holding "Shift" button on your keyboard. In the "choose an option" window click on the "Troubleshoot", next select "Advanced options". In the advanced options menu select "Startup Settings" and click on the "Restart" button. In the following window you should click the "F5" button on your keyboard. This will restart your operating system in safe mode with networking.

windows 10 safe mode with networking

Video showing how to start Windows 10 in "Safe Mode with Networking":

Windows 10 users: Click the Windows logo and select the Power icon. In the opened menu click "Restart" while holding "Shift" button on your keyboard. In the "choose an option" window click on the "Troubleshoot", next select "Advanced options". In the advanced options menu select "Startup Settings" and click on the "Restart" button. In the following window you should click the "F5" button on your keyboard. This will restart your operating system in safe mode with networking.

windows 10 safe mode with networking

Video showing how to start Windows 10 in "Safe Mode with Networking":

Step 2

Log in to the account infected with the CryptoWall virus. Start your Internet browser and download a legitimate anti-spyware program. Update the anti-spyware software and start a full system scan. Remove all entries detected.

If you cannot start your computer in Safe Mode with Networking, try performing a System Restore.

Video showing how to remove ransomware virus using "Safe Mode with Command Prompt" and "System Restore":

1. During your computer starting process, press the F8 key on your keyboard multiple times until the Windows Advanced Options menu appears, and then select Safe Mode with Command Prompt from the list and press ENTER.

Boot your computer in Safe Mode with Command Prompt

2. When Command Prompt mode loads, enter the following line: cd restore and press ENTER.

system restore using command prompt type cd restore

3. Next, type this line: rstrui.exe and press ENTER.

system restore using command prompt rstrui.exe

4. In the opened window click "Next".

restore system files and settings

5. Select one of the available Restore Points and click "Next" (this will restore your computer system to an earlier time and date, prior to the CryptoWall ransomware virus infiltrating your PC).

select a restore point

6. In the opened window click "Yes".

run system restore

7. After restoring your computer to a previous date, download and scan your PC with recommended malware removal software to eliminate any remaining CryptoWall files.

To restore individual files encrypted by this ransomware, try using Windows Previous Versions feature. This method is only effective if the System Restore function was enabled on an infected operating system. Note that some variants of CryptoWall are known to remove Shadow Volume Copies of the files, so this method may not work on all computers.

To restore a file, right-click on it, go into Properties, and select the Previous Versions tab. If the relevant file has a Restore Point, select it and click the "Restore" button.

Restoring files encrypted by CryptoDefense

If you cannot start your computer in Safe Mode with Networking (or with Command Prompt),boot your computer using a rescue disk. Some variants of ransomware disable Safe Mode making its removal complicated. For this step, you require access to another computer.

To regain control of the files encrypted by CryptoWall you can also try using a program called Shadow Explorer. More information on how to use this program is available here.

shadow explorer screenshot

 To protect your computer from file encrypting ransomware such as this, use reputable antivirus and anti-spyware programs. As an extra protection method, you can use programs called HitmanPro.Alert and Malwarebytes Anti-Ransomware, which artificially implant group policy objects into the registry to block rogue programs such as CryptoWall.)

HitmanPro.Alert CryptoGuard - detects encryption of files and neutralises such attempts without need for user intervention:

hitmanproalert ransomware prevention application

Malwarebytes Anti-Ransomware Beta uses advanced proactive technology that monitors ransomware activity and terminates it immediately - before reaching users' files:

malwarebytes anti-ransomware

  • The best way to avoid damage from ransomware infections is to maintain regular up-to-date backups. More information on online backup solutions and data recovery software Here.

Other tools known to remove CryptoWall ransomware:

janice dewdney

These people let you backup nothing without there being malicious code stuck in it somewhere. Agreed when we are clear we should back up

janice dewdney

I don't trust Malwarebytes because of one experience when I had to hard shut down my pc because I used a tool they had that was supposed to be free. When I say hard shut down I really mean hard..While I was pressing on shut down my machine was revving like a big engine. I could feel the magnetic force as I am ultra sensitive. All of my hairs were standing on end even after the shut down. My whole house is badly infected with the wifi detection and telephone cables being tampered with. This is all happening locally as well as globally. Virtual browsing and machines on your computer are put there by certain cards you put in when you are installing the drivers. I have a camera, not mentioning make. When I put the cards in the pc immediately hijacked it and uses it as a bridge. So then I read the instructions which needed a very strong magnifier. THIS IS VERY WRONG AND BAD PRACTICE. There it was the software had the ability to download the virtual OS, IOS, I think. My cyber criminals have never missed a chance no matter what I put in my pc.

Malwarebytes were sending me popups for my card details. I had created a post on my pages on facebook to make sure I was heard. My facebook is hijacked, google, ebay, home phone, my router (Super hub 3.0) by Virgin Media. So I then did another post reminding Malwarebytes I had not mentioned a name and to back to hell off or I would create trouble for them. I am not stupid, I know they can shut me down or do whatever they want with my pc but now it costs them as I have learned a few tricks. When I cant get connected or sound and everything I try gets me no where, then I get annoyed.

I get annoyed, then the naughty Janice laughs and think it's time..I carry on ranting about how funny I find it when I first remove all the hard wires connected, then cmos battery, disconnect the hard drives, routers in a plastic bags with anything wifi related. I even tape over all remote control led lights on my separate sound system as I know they are through them too. I take great pleasure in knowing I have upset their illegal hijacking scams to use our machines in a botneck to mine for bitcoin. It used to end up in me carrying my pc round to the net café for a clean install of windows. This is a couple of years ago. Now I know a bit more about my pc and how it works. I like getting into the motherboard writing down all the information I can then research when I get back online. Now I will not take my pc anywhere to get a new OS even if it means going and buying new.

This does not happen because I get watched so much they, cyber criminals know what I know. I used to hate researching anything technical because I was alien to technical language. I then started to watch youtube videos and could follow what to do by keeping pausing the video and copying. They are totally taking liberties with misinformed people and misinformation. They are disgraceful. I have since learned through a really bad outbreak of psoriasis that I have to let go of the cyber , virtual torment. I managed to clear this disease naturally by researching. Then detoxing and changing my diet.

I also see the video and F8 mentioned. Well I did find my way through a virtual OS or another tool on my pc that took me to 'their' porthole into facebook. This screen could not be made any bigger. I could mess with the files while I watched Mark & mates and their boring videos. I changed some settings that seemed to have made a difference. I am also willing to cut back drastically on internet and finding another way to connect that is not through any big companies with unlimited downloads including a phone line. They hijack your phone by splitting it in the extension outside.

How can any company expect you to release your card & bank info over an infected computer. They leave no telephone number.

So malwarebytes prove me wrong.

Un-hijack me for free and I will advertise it on my pc's along with a blog

Cryptolock is on all of our pc's


Those who have lost their data, sorry for them.
Those who have time download and install Hitman pro...
Thank God .. My pc is safe now I was scared af....

MalwareBytes just sucks it's slow and doesn't work at all so who ever suggests MalwareBytes punch him in the face....

Randy Rjd

yes. with online back up sites there is no excuses anymore. dropbox, google drive etc. plenty to choose from.

Randy Rjd

I have a laptop someone brought to me with this on it. it locked the drive down to where it turned off the SMART and blocks the id of the drive from the seatools from seagate. I can access the files via linux and recovered everything of value off the drive. but the drive is worthless. not even linux will install on it. using gparted also doesn't work. windows will also not install on it. everything gets to a point and stops. windows 7 system restore would not work, the computer would not start in safe mode either! so this virus is one nasty bugger!

Bíró Botond

Hi! I got infected by Cryptowall. Is it possible, that after the
infection even though a file is not encrypted and doesn't seem infected,
it still is? Just because I see a lot of files that are already
unaccessible due the encryption, their extension is already modified,
but some files seem untouched. Or at least are still accessible and are
not yet encrypted. As I understood from the things I read about this
ransom, the encrypted files are not infectious, only there is program
that runs in the background and scans all the files on all drives, makes
a copy of them, encrypts the copy and deletes the originals with the
shadow files etc. But this one thing I asked is still not clear.

Pallab Das

all my memories are gone with this stupid virus , it affects my all drives all my 2tb drives
but it cant encrypt big files such as 700mb to 1gb movies. E-scan boot scan works to rertive them back but chances are 50-50

Varga Zoltán

Dear John, It happened to me yesterday. Literally my life is ruined. I don't know what to do. :(


new update.. the cryptowall ransomware that has infected my computer has now seemed to gone out and deleted all restore points that were on the system, and any attempt to locate and fix this issues on my end has ended with no ground gained.


Dude think again it also infected my windows seven... N even a friend's win8


My heart is truly broken. I got hit by this stupid virus and now I lost all the pictures I had left of my 13yr old sister who died 4 years ago, the pictures I had of our dog that we had to put down because of old age, and all the photos I had of my grandfather before he passed away, as well as all of the photos of my children growing up. My heart hurts.


Nailed me on Windows 8.. This never happens on a PC (Piece of Crap)


the fact you're still running XP is likely why you were infected...

Yaniv Cohen

My computer infected by the cryptwall virus.
If anyone does indeed come up with a way to decrypt the files, please let us know .

I searched on several forums but there's no optimistic direction yet.

yaniv cohen

Nathan Justice

yes it can get


one question, can this thing infect a usb flash drive? or can it be transmited through a dropbox file? my old pc is infected and i am concern it may have infected my new one.

thanx for everything

Carlos Davila

My whole 3TB drive with all my pics and videos are also encrypted with the stupit virus! damn! If I find anything I'll keep you updated.

Roya Roy

I having the same problem through this virus. All photographs of my three years old baby since her born lost :( I urged all of you please help me to rectify the error. please give information. Thank you

Kunta Kente

I found an almost solution guys and gals: Right click the document in question and restore it to a previous version. This allows you to open them again.

I too, was a victim. I doubt my temp fix will work for long though as I bet the criminals look for pages just like this to fix issues with their virus.


please be aware dont give your money to these criminals it wont work!

not important

F$#@%G AS@#$%S... I hope they rot in hell until the end of time. I lost everything!

About the author:

Tomas Meskauskas

Tomas Meskauskas - expert security researcher, professional malware analyst.

I am passionate about computer security and technology. I have an experience of over 10 years working in various companies related to computer technical issue solving and Internet security. I have been working as an author and editor for since 2010. Follow me on Twitter and LinkedIn to stay informed about the latest online security threats. Contact Tomas Meskauskas.

PCrisk security portal is brought by a company RCS LT. Joined forces of security researchers help educate computer users about the latest online security threats. More information about the company RCS LT.

Our malware removal guides are free. However, if you want to support us you can send us a donation.

Malware activity

Global malware activity level today:

Medium threat activity

Increased attack rate of infections detected within the last 24 hours.

QR Code
Help_Recover_Instructions virus QR code
A QR code (Quick Response Code) is a machine-readable code which stores URLs and other information. This code can be read using a camera on a smartphone or a tablet. Scan this QR code to have an easy access removal guide of Help_Recover_Instructions virus on your mobile device.
We Recommend:

Get rid of Windows malware infections today:

Download Malwarebytes

Platform: Windows

Editors' Rating for Malwarebytes:
Editors ratingOutstanding!

[Back to Top]

To use full-featured product, you have to purchase a license for Malwarebytes. 14 days free trial available.