10/10/2015 Remove CryptoWall 3.0 virus (Files Encrypted Ransomware)

data:text/html;charset=utf­8,%3Ch1%20class%3D%22entry­title%22%20style%3D%22color%3A%20rgb(46%2C%2040%2C%2036)%3B%20font­family%3A... 1/20

Remove CryptoWall 3.0 virus (FilesEncrypted Ransomware)CryptoWall 3.0 is a file­encrypting ransomware, which will encrypt the personal documentsfound on victim’s computer using RSA­2048 key (AES CBC 256­bit encryption algorithm).CryptoWall 3.0 then displays a message which offers to decrypt the data if a payment of $500(and after 7 days goes up to $1,000) is made within 96 hours, otherwise the data will bedestroyed. This ransom must be paid in Bitcoins and sent to a Bitcoin address that changes perinfected user.

Once the infection has encrypted the files on your computer drives it will open a Notepadwindow that contains instructions on how to access the CryptoWall Decryption Service whereyou can pay a ransom to purchase a decryption program.

10/10/2015 Remove CryptoWall 3.0 virus (Files Encrypted Ransomware)

data:text/html;charset=utf­8,%3Ch1%20class%3D%22entry­title%22%20style%3D%22color%3A%20rgb(46%2C%2040%2C%2036)%3B%20font­family%3A... 2/20

We cannot help your recover your files, apart from suggesting touse ShadowExplorer or (free) File Recovery Software. This guide was written to helpyou remove the infection itself, and if a 100% proven method to recover the encrypted filesis found, we will update this guide.

1. How did the CryptoWall 3.0 virus got on my computer?2. What is CryptoWall 3.0 Ransomware?

3. Is my computer infected with CryptoWall 3.0 virus?4. Is it possible to decrypt files encrypted by CryptoWall 3.0?

5. How to remove the CryptoWall 3.0 ransomware (Virus Removal Guide)

1. How did the CryptoWall 3.0 virus got onmy computer?

The CryptoWall 3.0 virus is distributed through several means. Malicious websites, or legitimatewebsites that have been hacked, can infect your machine through exploit kits that usevulnerabilities on your computer to install this Trojan without your permission of knowledge.

10/10/2015 Remove CryptoWall 3.0 virus (Files Encrypted Ransomware)

data:text/html;charset=utf­8,%3Ch1%20class%3D%22entry­title%22%20style%3D%22color%3A%20rgb(46%2C%2040%2C%2036)%3B%20font­family%3A... 3/20

Another method used to propagate this type of malware is spam email containing infectedattachments or links to malicious websites. Cyber­criminals spam out an email, with forgedheader information, tricking you into believing that it is from a shipping company like DHL orFedEx. The email tells you that they tried to deliver a package to you, but failed for somereason. Sometimes the emails claim to be notifications of a shipment you have made. Eitherway, you can’t resist being curious as to what the email is referring to – and open the attachedfile (or click on a link embedded inside the email). And with that, your computer is infected withthe CryptoWall 3.0 virus.

The threat may also be downloaded manually by tricking the user into thinking they areinstalling a useful piece of software, for instance a bogus update for Adobe Flash Player oranother piece of software.

2. What is CryptoWall 3.0 Ransomware?CryptoWall 3.0 is a trojan ransomware program which targets all versions of Windows includingWindows XP, Windows Vista, Windows 7, and Windows 8. This infection is notable due to howit encrypts the user’s files – namely, it uses AES­265 and RSA encryption method – in order toensure that the affected user has no choice but to purchase the private key.

When CryptoWall 3.0 ransomware is first installed on your computer it will create a randomnamed executable in the %AppData% or %LocalAppData% folder. This executable will belaunched and begin to scan all the drive letters on your computer for data files to encrypt.CryptoWall 3.0 searches for files with certain file extensions to encrypt. The files it encryptsinclude important productivity documents and files such as .doc, .docx, .xls, .pdf, among others.Files targeted are those commonly found on most PCs today; a list of file extensions fortargeted files include:

.sql, .mp4, .7z, .rar, .m4a, .wma, .avi, .wmv, .csv, .d3dbsp, .zip, .sie, .sum,

.ibank, .t13, .t12, .qdf, .gdb, .tax, .pkpass, .bc6, .bc7, .bkp, .qic, .bkf, .sidn,

.sidd, .mddata, .itl, .itdb, .icxs, .hvpl, .hplg, .hkdb, .mdbackup, .syncdb, .gho,

.cas, .svg, .map, .wmo, .itm, .sb, .fos, .mov, .vdf, .ztmp, .sis, .sid, .ncf, .menu,

.layout, .dmp, .blob, .esm, .vcf, .vtf, .dazip, .fpk, .mlx, .kf, .iwd, .vpk, .tor, .psk,

.rim, .w3x, .fsh, .ntl, .arch00, .lvl, .snx, .cfr, .ff, .vpp_pc, .lrf, .m2, .mcmeta,

10/10/2015 Remove CryptoWall 3.0 virus (Files Encrypted Ransomware)

data:text/html;charset=utf­8,%3Ch1%20class%3D%22entry­title%22%20style%3D%22color%3A%20rgb(46%2C%2040%2C%2036)%3B%20font­family%3A... 4/20

.vfs0, .mpqge, .kdb, .db0, .dba, .rofl, .hkx, .bar, .upk, .das, .iwi, .litemod,

.asset, .forge, .ltx, .bsa, .apk, .re4, .sav, .lbf, .slm, .bik, .epk, .rgss3a, .pak, .big,wallet, .wotreplay, .xxx, .desc, .py, .m3u, .flv, .js, .css, .rb, .png, .jpeg, .txt,.p7c, .p7b, .p12, .pfx, .pem, .crt, .cer, .der, .x3f, .srw, .pef, .ptx, .r3d, .rw2, .rwl,.raw, .raf, .orf, .nrw, .mrwref, .mef, .erf, .kdc, .dcr, .cr2, .crw, .bay, .sr2, .srf,.arw, .3fr, .dng, .jpe, .jpg, .cdr, .indd, .ai, .eps, .pdf, .pdd, .psd, .dbf, .mdf,.wb2, .rtf, .wpd, .dxg, .xf, .dwg, .pst, .accdb, .mdb, .pptm, .pptx, .ppt, .xlk,.xlsb, .xlsm, .xlsx, .xls, .wps, .docm, .docx, .doc, .odb, .odc, .odm, .odp, .ods,.odt

While encrypting your files, this ransomware also create aHELP_DECRYPT.txt text file ransomnote in each folder that a file has been encrypted and on the Windows desktop. Theransomware will also change your Windows desktop wallpaper to HELP_DECRYPT.html.Both the wallpaper and the text ransom note will contain the same information on how toaccess the payment site and get your files back.When you go to the URLs listed in the ransom note you will be taken to a TOR site where youcan learn how much your ransom is and how to make the payment.

CryptoWall 3.0 will also hijack your .EXE extensions so that when you launch an executable itwill attempt to delete the Shadow Volume Copies that are on the affected computer. It does thisbecause you can use shadow volume copies to restore your encrypted files. Once the infectionhas successfully deleted your shadow volume copies, it will restore your exe extensions back tothe Windows defaults.

When it has finished encrypting your data files it will then show the CryptoWall 3.0 screen asshown above and demand a ransom of 2.2330749 BTC (around 499 USD) in order to decryptyour files. It also states that you must pay this ransom within 96 hours or the private encryptionkey will be destroyed on the developer’s servers.

3. Is my computer infected with CryptoWall3.0 virus?

If your computer is infected with the CryptoWall 3.0 ransomware will display ablack HELP_DECRYPT.html wallpaper that covers the entire desktop.

10/10/2015 Remove CryptoWall 3.0 virus (Files Encrypted Ransomware)

data:text/html;charset=utf­8,%3Ch1%20class%3D%22entry­title%22%20style%3D%22color%3A%20rgb(46%2C%2040%2C%2036)%3B%20font­family%3A... 5/20

A HELP_DECRYPT.txt text file will be placed on your desktop. Both files contain instruction onhow or recover the encrypted files.

The messages displayed by this ransomware infection can be localized depending on theuser’s location, with text written in the appropriate language.

What happened to your files?

All of your files were protected by a strong encryption with RSA­2048 using CryptoWall.More information about the encryption keys using RSA­2048 can be found here:en.wikipedia.org/wiki/RSA_(crypto system)

What does this mean?

This means that the structure and data within your files have been irrevocably changed,you will not be able to work with them, read them or see them, it is the same thing aslosing them forever, but with our help, you can restore them.

How did this happen?

Especially for you, on our server was generated the secret key pair RSA­2048 – publicand private. All your files were encrypted with the public key, which has been transferredto your computer via the Internet. Decrypting of your files is only possible with the help ofthe private key and decrypt program, which is on our secret server.

What do I do?

Alas, if you do not take the necessary measures for the specified time then the conditionsfor obtaining the private key will be changed. If you really value your data, then wesuggest you do not waste valuable time searching for the solutions because they do notexist.For more specific instructions, please visit your personal home page, there are a fewdifferent addresses pointing to your page below:

CryptoWall 3.0

10/10/2015 Remove CryptoWall 3.0 virus (Files Encrypted Ransomware)

data:text/html;charset=utf­8,%3Ch1%20class%3D%22entry­title%22%20style%3D%22color%3A%20rgb(46%2C%2040%2C%2036)%3B%20font­family%3A... 6/20

1. hxxps://link2. hxxps://link3. hxxps://link

If for some reasons the addresses are not available, follow these steps:

1. Download and install tor­browser:hxxp://www.torproject.org/projects/torbrowser.html.en2. After a successful installation, run the browser and wait for initialization.3. Type in the address bar: [letters]4. Follow the instructions on the site.

4. Is it possible to decrypt files encrypted byCryptoWall 3.0?

No, at this time it’s not possible.CryptoWall 3.0 is notable due to how it encrypts the user’s files – namely, it uses AES­265 andRSA encryption method – in order to ensure that the affected user has no choice but topurchase the private key. The RSA public key can only be decrypted with its correspondingprivate key. Since the AES key is hidden using RSA encryption and the RSA private key is notavailable, decrypting the files is not feasible as of this writing.Brute forcing the decryption key is not realistic due to the length of time required to break anAES encryption key.

So unfortunately, once the CryptoWall 3.0 encryption of the data is complete, decryptionis not feasible without paying the ransom on Decryption Service site.

Because the needed private key to unlock the encrypted file is only available through the cybercriminals, victims may be tempted to purchase it and pay the exorbitant fee. However, doing somay encourage these bad guys to continue and even expand their operations. We stronglysuggest that you do not send any money to these cyber criminals, and instead adress to thelaw enforcement agency in your country to report this attack.

CryptoWall Decryption Service

10/10/2015 Remove CryptoWall 3.0 virus (Files Encrypted Ransomware)

data:text/html;charset=utf­8,%3Ch1%20class%3D%22entry­title%22%20style%3D%22color%3A%20rgb(46%2C%2040%2C%2036)%3B%20font­family%3A... 7/20

5. How to remove the CryptoWall 3.0ransomware (Virus Removal Guide)

If you DO NOT plan on paying the ransom and want to try to restore your files, you canfollow the below guide. It’s important to understand that by starting the removal process,you risk of losing your files, as we cannot guarantee that you will be able to recover them.Furthermore, your files may be permanently compromised when trying to remove thisinfection or trying to recover the encrypted documents.

This page is a comprehensive guide, which will remove the CryptoWall 3.0 infection from yourcomputer, however we cannot guarantee that your personal files will be recovered. We cannotbe held responsible for losing the documents during this removal process.

A. Remove CryptoWall 3.0 ransomware from yourcomputer

Malwarebytes and HitmanPro can detect and remove this infection, buttheseprograms cannot recover your encrypted files due to the nature of asymmetric encryption,which requires a private key to decrypt files encrypted with the public key.

STEP 1: Remove CryptoWall 3.0 virus with MalwarebytesAnti­Malware FreeMalwarebytes Anti­Malware Free uses industry­leading technology to detect and remove alltraces of malware, including worms, Trojans, rootkits, rogues, dialers, spyware, and more.It is important to note that Malwarebytes Anti­Malware works well and should run alongsideantivirus software without conflicts.

1. You can download download Malwarebytes Anti­Malware from the below link.MALWAREBYTES ANTI­MALWARE DOWNLOAD LINK (This link will open a new webpage from where you can download “Malwarebytes Anti­Malware Free”)

2. Once downloaded, close all programs, then double­click on the icon on your desktopnamed “mbam­setup” to start the installation of Malwarebytes Anti­Malware.

10/10/2015 Remove CryptoWall 3.0 virus (Files Encrypted Ransomware)

data:text/html;charset=utf­8,%3Ch1%20class%3D%22entry­title%22%20style%3D%22color%3A%20rgb(46%2C%2040%2C%2036)%3B%20font­family%3A... 8/20

You may be presented with a User Account Control dialog asking you if you want to runthis file. If this happens, you should click “Yes” to continue with the installation.

3. When the installation begins, you will see the Malwarebytes Anti­Malware SetupWizard which will guide you through the installation process.

To install Malwarebytes Anti­Malware on your machine, keep following the prompts byclicking the “Next” button.

10/10/2015 Remove CryptoWall 3.0 virus (Files Encrypted Ransomware)

data:text/html;charset=utf­8,%3Ch1%20class%3D%22entry­title%22%20style%3D%22color%3A%20rgb(46%2C%2040%2C%2036)%3B%20font­family%3A... 9/20

4. Once installed, Malwarebytes Anti­Malware will automatically start and you will see amessage stating that you should update the program, and that a scan has never been runon your system. To start a system scan you can click on the “Scan Now” button.

10/10/2015 Remove CryptoWall 3.0 virus (Files Encrypted Ransomware)

data:text/html;charset=utf­8,%3Ch1%20class%3D%22entry­title%22%20style%3D%22color%3A%20rgb(46%2C%2040%2C%2036)%3B%20font­family%3... 10/20

5. Malwarebytes Anti­Malware will now start scanning your computer for the CryptoWall 3.0virus. When Malwarebytes Anti­Malware is scanning it will look like the image below.

10/10/2015 Remove CryptoWall 3.0 virus (Files Encrypted Ransomware)

data:text/html;charset=utf­8,%3Ch1%20class%3D%22entry­title%22%20style%3D%22color%3A%20rgb(46%2C%2040%2C%2036)%3B%20font­family%3... 11/20

6. When the scan has completed, you will now be presented with a screen showing you themalware infections that Malwarebytes Anti­Malware has detected. To remove themalicious programs that Malwarebytes Anti­malware has found, click on the “RemoveSeletected” button.

10/10/2015 Remove CryptoWall 3.0 virus (Files Encrypted Ransomware)

data:text/html;charset=utf­8,%3Ch1%20class%3D%22entry­title%22%20style%3D%22color%3A%20rgb(46%2C%2040%2C%2036)%3B%20font­family%3... 12/20

Please note that the infections found may be different than what is shown in the image.7. Malwarebytes Anti­Malware will now quarantine all the malicious files and registry keys

that it has found. When removing the files, Malwarebytes Anti­Malware may require areboot in order to remove some of them. If it displays a message stating that it needs toreboot your computer, please allow it to do so.

10/10/2015 Remove CryptoWall 3.0 virus (Files Encrypted Ransomware)

data:text/html;charset=utf­8,%3Ch1%20class%3D%22entry­title%22%20style%3D%22color%3A%20rgb(46%2C%2040%2C%2036)%3B%20font­family%3... 13/20

After your computer will restart, you should open Malwarebytes Anti­Malware and performanother “Threat Scan” scan to verify that there are no remaining threats

STEP 2: Double­check for the “CryptoWall 3.0” malwareinfection with HitmanProHitmanPro is a second opinion scanner, designed to rescue your computer from malware(viruses, trojans, rootkits, etc.) that have infected your computer despite all the securitymeasures you have taken (such as anti­virus software, firewalls, etc.). HitmanPro is designed towork alongside existing security programs without any conflicts. It scans the computer quickly(less than 5 minutes) and does not slow down the computer.

1. You can download HitmanPro from the below link:HITMANPRO DOWNLOAD LINK (This link will open a new web page from where you candownload “HitmanPro”)

2. Double­click on the file named “HitmanPro.exe” (for 32­bit versions of Windows) or“HitmanPro_x64.exe” (for 64­bit versions of Windows). When the program starts you willbe presented with the start screen as shown below.

10/10/2015 Remove CryptoWall 3.0 virus (Files Encrypted Ransomware)

data:text/html;charset=utf­8,%3Ch1%20class%3D%22entry­title%22%20style%3D%22color%3A%20rgb(46%2C%2040%2C%2036)%3B%20font­family%3... 14/20

Click on the “Next” button, to install HitmanPro on your computer.

10/10/2015 Remove CryptoWall 3.0 virus (Files Encrypted Ransomware)

data:text/html;charset=utf­8,%3Ch1%20class%3D%22entry­title%22%20style%3D%22color%3A%20rgb(46%2C%2040%2C%2036)%3B%20font­family%3... 15/20

3. HitmanPro will now begin to scan your computer for CryptoWall 3.0 malicious files.

10/10/2015 Remove CryptoWall 3.0 virus (Files Encrypted Ransomware)

data:text/html;charset=utf­8,%3Ch1%20class%3D%22entry­title%22%20style%3D%22color%3A%20rgb(46%2C%2040%2C%2036)%3B%20font­family%3... 16/20

4. When it has finished it will display a list of all the malware that the program found asshown in the image below. Click on the “Next” button, to remove CryptoWall 3.0 virus.

10/10/2015 Remove CryptoWall 3.0 virus (Files Encrypted Ransomware)

data:text/html;charset=utf­8,%3Ch1%20class%3D%22entry­title%22%20style%3D%22color%3A%20rgb(46%2C%2040%2C%2036)%3B%20font­family%3... 17/20

5. Click on the “Activate free license” button to begin the free 30 days trial, and remove allthe malicious files from your computer.

10/10/2015 Remove CryptoWall 3.0 virus (Files Encrypted Ransomware)

data:text/html;charset=utf­8,%3Ch1%20class%3D%22entry­title%22%20style%3D%22color%3A%20rgb(46%2C%2040%2C%2036)%3B%20font­family%3... 18/20

In some cases you may need to change your wallpaper, and delete the harmlessSave_Files, DECRYTP_INSTRUCTIONS.txt and DECRYTP_INSTRUCTIONS.html files.

B. How (try) to restore your files encrypted by CryptoWall3.0 ransomware

In some cases, it may be possible to recover previous versions of the encrypted files usingSystem Restore or other recovery software used to obtain “shadow copies” of files.

Option 1: Restore your files encrypted by CryptoWall 3.0ransomware with ShadowExplorerCryptoWall 3.0 will attempt to delete all shadow copies when you first start any executable onyour computer after becoming infected. Thankfully, the infection is not always able to remove

10/10/2015 Remove CryptoWall 3.0 virus (Files Encrypted Ransomware)

data:text/html;charset=utf­8,%3Ch1%20class%3D%22entry­title%22%20style%3D%22color%3A%20rgb(46%2C%2040%2C%2036)%3B%20font­family%3... 19/20

the shadow copies, so you should continue to try restoring your files using this method.

1. You can download ShadowExplorer from the below link:SHADOW EXPLORER DOWNLOAD LINK (This link will open a new web page fromwhere you can download “ShadowExplorer”)

2. Once you have downloaded and installed ShadowExplorer, you can follow the below videoguide on how to restore your files while using this program.

Se produjo un error.

Try watching this video on www.youtube.com, or enable JavaScript if it is disabled inyour browser.

Alternatively, you can use the System Restore to try to recover the encrypted documents.

Option 2: Restore your files encrypted by CryptoWall 3.0ransomware with File Recovery SoftwareWhen CryptoWall 3.0 encrypts a file it first makes a copy of it, encrypts the copy, and thendeletes the original. Due to this you can use file recovery software such as:

RecuvaYou can follow the below guide on how to use Recuva:

10/10/2015 Remove CryptoWall 3.0 virus (Files Encrypted Ransomware)

data:text/html;charset=utf­8,%3Ch1%20class%3D%22entry­title%22%20style%3D%22color%3A%20rgb(46%2C%2040%2C%2036)%3B%20font­family%3... 20/20

EaseUS Data Recovery Wizard Free

R­Studio