10/10/2015

RemoveCryptoWall3.0virus(FilesEncryptedRansomware)

RemoveCryptoWall3.0virus(Files
EncryptedRansomware)
CryptoWall3.0isafileencryptingransomware,whichwillencryptthepersonaldocuments
foundonvictimscomputerusingRSA2048key(AESCBC256bitencryptionalgorithm).
CryptoWall3.0thendisplaysamessagewhichofferstodecryptthedataifapaymentof$500
(andafter7daysgoesupto$1,000)ismadewithin96hours,otherwisethedatawillbe
destroyed.ThisransommustbepaidinBitcoinsandsenttoaBitcoinaddressthatchangesper
infecteduser.
OncetheinfectionhasencryptedthefilesonyourcomputerdrivesitwillopenaNotepad
windowthatcontainsinstructionsonhowtoaccesstheCryptoWallDecryptionServicewhere
youcanpayaransomtopurchaseadecryptionprogram.

data:text/htmlcharset=utf8,%3Ch1%20class%3D%22entrytitle%22%20style%3D%22color%3A%20rgb(46%2C%2040%2C%2036)%3B%20fontfamily%3A...

1/20

10/10/2015

RemoveCryptoWall3.0virus(FilesEncryptedRansomware)

Wecannothelpyourrecoveryourfiles,apartfromsuggestingto
useShadowExploreror(free)FileRecoverySoftware.Thisguidewaswrittentohelp
youremovetheinfectionitself,andifa100%provenmethodtorecovertheencryptedfiles
isfound,wewillupdatethisguide.
1.HowdidtheCryptoWall3.0virusgotonmycomputer?
2.WhatisCryptoWall3.0Ransomware?
3.IsmycomputerinfectedwithCryptoWall3.0virus?
4.IsitpossibletodecryptfilesencryptedbyCryptoWall3.0?
5.HowtoremovetheCryptoWall3.0ransomware(VirusRemovalGuide)

1.HowdidtheCryptoWall3.0virusgoton
mycomputer?
TheCryptoWall3.0virusisdistributedthroughseveralmeans.Maliciouswebsites,orlegitimate
websitesthathavebeenhacked,caninfectyourmachinethroughexploitkitsthatuse
vulnerabilitiesonyourcomputertoinstallthisTrojanwithoutyourpermissionofknowledge.
data:text/htmlcharset=utf8,%3Ch1%20class%3D%22entrytitle%22%20style%3D%22color%3A%20rgb(46%2C%2040%2C%2036)%3B%20fontfamily%3A...

2/20

10/10/2015

RemoveCryptoWall3.0virus(FilesEncryptedRansomware)

Anothermethodusedtopropagatethistypeofmalwareisspamemailcontaininginfected
attachmentsorlinkstomaliciouswebsites.Cybercriminalsspamoutanemail,withforged
headerinformation,trickingyouintobelievingthatitisfromashippingcompanylikeDHLor
FedEx.Theemailtellsyouthattheytriedtodeliverapackagetoyou,butfailedforsome
reason.Sometimestheemailsclaimtobenotificationsofashipmentyouhavemade.Either
way,youcantresistbeingcuriousastowhattheemailisreferringtoandopentheattached
file(orclickonalinkembeddedinsidetheemail).Andwiththat,yourcomputerisinfectedwith
theCryptoWall3.0virus.
Thethreatmayalsobedownloadedmanuallybytrickingtheuserintothinkingtheyare
installingausefulpieceofsoftware,forinstanceabogusupdateforAdobeFlashPlayeror
anotherpieceofsoftware.

2.WhatisCryptoWall3.0Ransomware?
CryptoWall3.0isatrojanransomwareprogramwhichtargetsallversionsofWindowsincluding
WindowsXP,WindowsVista,Windows7,andWindows8.Thisinfectionisnotableduetohow
itencryptstheusersfilesnamely,itusesAES265andRSAencryptionmethodinorderto
ensurethattheaffecteduserhasnochoicebuttopurchasetheprivatekey.
WhenCryptoWall3.0ransomwareisfirstinstalledonyourcomputeritwillcreatearandom
namedexecutableinthe%AppData%or%LocalAppData%folder.Thisexecutablewillbe
launchedandbegintoscanallthedrivelettersonyourcomputerfordatafilestoencrypt.
CryptoWall3.0searchesforfileswithcertainfileextensionstoencrypt.Thefilesitencrypts
includeimportantproductivitydocumentsandfilessuchas.doc,.docx,.xls,.pdf,amongothers.
FilestargetedarethosecommonlyfoundonmostPCstodayalistoffileextensionsfor
targetedfilesinclude:

.sql,.mp4,.7z,.rar,.m4a,.wma,.avi,.wmv,.csv,.d3dbsp,.zip,.sie,.sum,
.ibank,.t13,.t12,.qdf,.gdb,.tax,.pkpass,.bc6,.bc7,.bkp,.qic,.bkf,.sidn,
.sidd,.mddata,.itl,.itdb,.icxs,.hvpl,.hplg,.hkdb,.mdbackup,.syncdb,.gho,
.cas,.svg,.map,.wmo,.itm,.sb,.fos,.mov,.vdf,.ztmp,.sis,.sid,.ncf,.menu,
.layout,.dmp,.blob,.esm,.vcf,.vtf,.dazip,.fpk,.mlx,.kf,.iwd,.vpk,.tor,.psk,
.rim,.w3x,.fsh,.ntl,.arch00,.lvl,.snx,.cfr,.ff,.vpp_pc,.lrf,.m2,.mcmeta,
data:text/htmlcharset=utf8,%3Ch1%20class%3D%22entrytitle%22%20style%3D%22color%3A%20rgb(46%2C%2040%2C%2036)%3B%20fontfamily%3A...

3/20

10/10/2015

RemoveCryptoWall3.0virus(FilesEncryptedRansomware)

.vfs0,.mpqge,.kdb,.db0,.dba,.rofl,.hkx,.bar,.upk,.das,.iwi,.litemod,
.asset,.forge,.ltx,.bsa,.apk,.re4,.sav,.lbf,.slm,.bik,.epk,.rgss3a,.pak,.big,
wallet,.wotreplay,.xxx,.desc,.py,.m3u,.flv,.js,.css,.rb,.png,.jpeg,.txt,
.p7c,.p7b,.p12,.pfx,.pem,.crt,.cer,.der,.x3f,.srw,.pef,.ptx,.r3d,.rw2,.rwl,
.raw,.raf,.orf,.nrw,.mrwref,.mef,.erf,.kdc,.dcr,.cr2,.crw,.bay,.sr2,.srf,
.arw,.3fr,.dng,.jpe,.jpg,.cdr,.indd,.ai,.eps,.pdf,.pdd,.psd,.dbf,.mdf,
.wb2,.rtf,.wpd,.dxg,.xf,.dwg,.pst,.accdb,.mdb,.pptm,.pptx,.ppt,.xlk,
.xlsb,.xlsm,.xlsx,.xls,.wps,.docm,.docx,.doc,.odb,.odc,.odm,.odp,.ods,
.odt

Whileencryptingyourfiles,thisransomwarealsocreateaHELP_DECRYPT.txttextfileransom
noteineachfolderthatafilehasbeenencryptedandontheWindowsdesktop.The
ransomwarewillalsochangeyourWindowsdesktopwallpapertoHELP_DECRYPT.html.
Boththewallpaperandthetextransomnotewillcontainthesameinformationonhowto
accessthepaymentsiteandgetyourfilesback.
WhenyougototheURLslistedintheransomnoteyouwillbetakentoaTORsitewhereyou
canlearnhowmuchyourransomisandhowtomakethepayment.
CryptoWall3.0willalsohijackyour.EXEextensionssothatwhenyoulaunchanexecutableit
willattempttodeletetheShadowVolumeCopiesthatareontheaffectedcomputer.Itdoesthis
becauseyoucanuseshadowvolumecopiestorestoreyourencryptedfiles.Oncetheinfection
hassuccessfullydeletedyourshadowvolumecopies,itwillrestoreyourexeextensionsbackto
theWindowsdefaults.
WhenithasfinishedencryptingyourdatafilesitwillthenshowtheCryptoWall3.0screenas
shownaboveanddemandaransomof2.2330749BTC(around499USD)inordertodecrypt
yourfiles.Italsostatesthatyoumustpaythisransomwithin96hoursortheprivateencryption
keywillbedestroyedonthedevelopersservers.

3.IsmycomputerinfectedwithCryptoWall
3.0virus?
IfyourcomputerisinfectedwiththeCryptoWall3.0ransomwarewilldisplaya
blackHELP_DECRYPT.htmlwallpaperthatcoverstheentiredesktop.
data:text/htmlcharset=utf8,%3Ch1%20class%3D%22entrytitle%22%20style%3D%22color%3A%20rgb(46%2C%2040%2C%2036)%3B%20fontfamily%3A...

4/20

10/10/2015

RemoveCryptoWall3.0virus(FilesEncryptedRansomware)

AHELP_DECRYPT.txttextfilewillbeplacedonyourdesktop.Bothfilescontaininstructionon
howorrecovertheencryptedfiles.
Themessagesdisplayedbythisransomwareinfectioncanbelocalizeddependingonthe
userslocation,withtextwrittenintheappropriatelanguage.

CryptoWall3.0

Whathappenedtoyourfiles?
AllofyourfileswereprotectedbyastrongencryptionwithRSA2048usingCryptoWall.
MoreinformationabouttheencryptionkeysusingRSA2048canbefoundhere:
en.wikipedia.org/wiki/RSA_(cryptosystem)
Whatdoesthismean?
Thismeansthatthestructureanddatawithinyourfileshavebeenirrevocablychanged,
youwillnotbeabletoworkwiththem,readthemorseethem,itisthesamethingas
losingthemforever,butwithourhelp,youcanrestorethem.
Howdidthishappen?
Especiallyforyou,onourserverwasgeneratedthesecretkeypairRSA2048public
andprivate.Allyourfileswereencryptedwiththepublickey,whichhasbeentransferred
toyourcomputerviatheInternet.Decryptingofyourfilesisonlypossiblewiththehelpof
theprivatekeyanddecryptprogram,whichisonoursecretserver.
WhatdoIdo?
Alas,ifyoudonottakethenecessarymeasuresforthespecifiedtimethentheconditions
forobtainingtheprivatekeywillbechanged.Ifyoureallyvalueyourdata,thenwe
suggestyoudonotwastevaluabletimesearchingforthesolutionsbecausetheydonot
exist.
Formorespecificinstructions,pleasevisityourpersonalhomepage,thereareafew
differentaddressespointingtoyourpagebelow:
data:text/htmlcharset=utf8,%3Ch1%20class%3D%22entrytitle%22%20style%3D%22color%3A%20rgb(46%2C%2040%2C%2036)%3B%20fontfamily%3A...

5/20

10/10/2015

RemoveCryptoWall3.0virus(FilesEncryptedRansomware)

1.hxxps://link
2.hxxps://link
3.hxxps://link
Ifforsomereasonstheaddressesarenotavailable,followthesesteps:
1.Downloadandinstalltorbrowser:
hxxp://www.torproject.org/projects/torbrowser.html.en
2.Afterasuccessfulinstallation,runthebrowserandwaitforinitialization.
3.Typeintheaddressbar:[letters]
4.Followtheinstructionsonthesite.

CryptoWallDecryptionService

4.Isitpossibletodecryptfilesencryptedby
CryptoWall3.0?
No,atthistimeitsnotpossible.
CryptoWall3.0isnotableduetohowitencryptstheusersfilesnamely,itusesAES265and
RSAencryptionmethodinordertoensurethattheaffecteduserhasnochoicebutto
purchasetheprivatekey.TheRSApublickeycanonlybedecryptedwithitscorresponding
privatekey.SincetheAESkeyishiddenusingRSAencryptionandtheRSAprivatekeyisnot
available,decryptingthefilesisnotfeasibleasofthiswriting.
Bruteforcingthedecryptionkeyisnotrealisticduetothelengthoftimerequiredtobreakan
AESencryptionkey.

Sounfortunately,oncetheCryptoWall3.0encryptionofthedataiscomplete,decryption
isnotfeasiblewithoutpayingtheransomonDecryptionServicesite.
Becausetheneededprivatekeytounlocktheencryptedfileisonlyavailablethroughthecyber
criminals,victimsmaybetemptedtopurchaseitandpaytheexorbitantfee.However,doingso
mayencouragethesebadguystocontinueandevenexpandtheiroperations.Westrongly
suggestthatyoudonotsendanymoneytothesecybercriminals,andinsteadadresstothe
lawenforcementagencyinyourcountrytoreportthisattack.
data:text/htmlcharset=utf8,%3Ch1%20class%3D%22entrytitle%22%20style%3D%22color%3A%20rgb(46%2C%2040%2C%2036)%3B%20fontfamily%3A...

6/20

10/10/2015

RemoveCryptoWall3.0virus(FilesEncryptedRansomware)

5.HowtoremovetheCryptoWall3.0
ransomware(VirusRemovalGuide)
IfyouDONOTplanonpayingtheransomandwanttotrytorestoreyourfiles,youcan
followthebelowguide.Itsimportanttounderstandthatbystartingtheremovalprocess,
youriskoflosingyourfiles,aswecannotguaranteethatyouwillbeabletorecoverthem.
Furthermore,yourfilesmaybepermanentlycompromisedwhentryingtoremovethis
infectionortryingtorecovertheencrypteddocuments.
Thispageisacomprehensiveguide,whichwillremovetheCryptoWall3.0infectionfromyour
computer,howeverwecannotguaranteethatyourpersonalfileswillberecovered.Wecannot
beheldresponsibleforlosingthedocumentsduringthisremovalprocess.

A.RemoveCryptoWall3.0ransomwarefromyour
computer
MalwarebytesandHitmanProcandetectandremovethisinfection,butthese
programscannotrecoveryourencryptedfilesduetothenatureofasymmetricencryption,
whichrequiresaprivatekeytodecryptfilesencryptedwiththepublickey.

STEP1:RemoveCryptoWall3.0viruswithMalwarebytes
AntiMalwareFree
MalwarebytesAntiMalwareFreeusesindustryleadingtechnologytodetectandremoveall
tracesofmalware,includingworms,Trojans,rootkits,rogues,dialers,spyware,andmore.
ItisimportanttonotethatMalwarebytesAntiMalwareworkswellandshouldrunalongside
antivirussoftwarewithoutconflicts.
1. YoucandownloaddownloadMalwarebytesAntiMalwarefromthebelowlink.
MALWAREBYTESANTIMALWAREDOWNLOADLINK(Thislinkwillopenanewweb
pagefromwhereyoucandownloadMalwarebytesAntiMalwareFree)
2. Oncedownloaded,closeallprograms,thendoubleclickontheicononyourdesktop
namedmbamsetuptostarttheinstallationofMalwarebytesAntiMalware.

data:text/htmlcharset=utf8,%3Ch1%20class%3D%22entrytitle%22%20style%3D%22color%3A%20rgb(46%2C%2040%2C%2036)%3B%20fontfamily%3A...

7/20

10/10/2015

RemoveCryptoWall3.0virus(FilesEncryptedRansomware)

YoumaybepresentedwithaUserAccountControldialogaskingyouifyouwanttorun
thisfile.Ifthishappens,youshouldclickYestocontinuewiththeinstallation.
3. Whentheinstallationbegins,youwillseetheMalwarebytesAntiMalwareSetup
Wizardwhichwillguideyouthroughtheinstallationprocess.

ToinstallMalwarebytesAntiMalwareonyourmachine,keepfollowingthepromptsby
clickingtheNextbutton.

data:text/htmlcharset=utf8,%3Ch1%20class%3D%22entrytitle%22%20style%3D%22color%3A%20rgb(46%2C%2040%2C%2036)%3B%20fontfamily%3A...

8/20

10/10/2015

RemoveCryptoWall3.0virus(FilesEncryptedRansomware)

4. Onceinstalled,MalwarebytesAntiMalwarewillautomaticallystartandyouwillseea
messagestatingthatyoushouldupdatetheprogram,andthatascanhasneverbeenrun
onyoursystem.TostartasystemscanyoucanclickontheScanNowbutton.

data:text/htmlcharset=utf8,%3Ch1%20class%3D%22entrytitle%22%20style%3D%22color%3A%20rgb(46%2C%2040%2C%2036)%3B%20fontfamily%3A...

9/20

10/10/2015

RemoveCryptoWall3.0virus(FilesEncryptedRansomware)

5. MalwarebytesAntiMalwarewillnowstartscanningyourcomputerfortheCryptoWall3.0
virus.WhenMalwarebytesAntiMalwareisscanningitwilllookliketheimagebelow.

data:text/htmlcharset=utf8,%3Ch1%20class%3D%22entrytitle%22%20style%3D%22color%3A%20rgb(46%2C%2040%2C%2036)%3B%20fontfamily%3...

10/20

10/10/2015

RemoveCryptoWall3.0virus(FilesEncryptedRansomware)

6. Whenthescanhascompleted,youwillnowbepresentedwithascreenshowingyouthe
malwareinfectionsthatMalwarebytesAntiMalwarehasdetected.Toremovethe
maliciousprogramsthatMalwarebytesAntimalwarehasfound,clickontheRemove
Seletectedbutton.

data:text/htmlcharset=utf8,%3Ch1%20class%3D%22entrytitle%22%20style%3D%22color%3A%20rgb(46%2C%2040%2C%2036)%3B%20fontfamily%3...

11/20

10/10/2015

RemoveCryptoWall3.0virus(FilesEncryptedRansomware)

Pleasenotethattheinfectionsfoundmaybedifferentthanwhatisshownintheimage.
7. MalwarebytesAntiMalwarewillnowquarantineallthemaliciousfilesandregistrykeys
thatithasfound.Whenremovingthefiles,MalwarebytesAntiMalwaremayrequirea
rebootinordertoremovesomeofthem.Ifitdisplaysamessagestatingthatitneedsto
rebootyourcomputer,pleaseallowittodoso.

data:text/htmlcharset=utf8,%3Ch1%20class%3D%22entrytitle%22%20style%3D%22color%3A%20rgb(46%2C%2040%2C%2036)%3B%20fontfamily%3...

12/20

10/10/2015

RemoveCryptoWall3.0virus(FilesEncryptedRansomware)

Afteryourcomputerwillrestart,youshouldopenMalwarebytesAntiMalwareandperform
anotherThreatScanscantoverifythattherearenoremainingthreats

STEP2:DoublecheckfortheCryptoWall3.0malware
infectionwithHitmanPro
HitmanProisasecondopinionscanner,designedtorescueyourcomputerfrommalware
(viruses,trojans,rootkits,etc.)thathaveinfectedyourcomputerdespiteallthesecurity
measuresyouhavetaken(suchasantivirussoftware,firewalls,etc.).HitmanProisdesignedto
workalongsideexistingsecurityprogramswithoutanyconflicts.Itscansthecomputerquickly
(lessthan5minutes)anddoesnotslowdownthecomputer.
1. YoucandownloadHitmanProfromthebelowlink:
HITMANPRODOWNLOADLINK(Thislinkwillopenanewwebpagefromwhereyoucan
downloadHitmanPro)
2. DoubleclickonthefilenamedHitmanPro.exe(for32bitversionsofWindows)or
HitmanPro_x64.exe(for64bitversionsofWindows).Whentheprogramstartsyouwill
bepresentedwiththestartscreenasshownbelow.

data:text/htmlcharset=utf8,%3Ch1%20class%3D%22entrytitle%22%20style%3D%22color%3A%20rgb(46%2C%2040%2C%2036)%3B%20fontfamily%3...

13/20

10/10/2015

RemoveCryptoWall3.0virus(FilesEncryptedRansomware)

ClickontheNextbutton,toinstallHitmanProonyourcomputer.

data:text/htmlcharset=utf8,%3Ch1%20class%3D%22entrytitle%22%20style%3D%22color%3A%20rgb(46%2C%2040%2C%2036)%3B%20fontfamily%3...

14/20

10/10/2015

RemoveCryptoWall3.0virus(FilesEncryptedRansomware)

3. HitmanProwillnowbegintoscanyourcomputerforCryptoWall3.0maliciousfiles.

data:text/htmlcharset=utf8,%3Ch1%20class%3D%22entrytitle%22%20style%3D%22color%3A%20rgb(46%2C%2040%2C%2036)%3B%20fontfamily%3...

15/20

10/10/2015

RemoveCryptoWall3.0virus(FilesEncryptedRansomware)

4. Whenithasfinisheditwilldisplayalistofallthemalwarethattheprogramfoundas
shownintheimagebelow.ClickontheNextbutton,toremoveCryptoWall3.0virus.

data:text/htmlcharset=utf8,%3Ch1%20class%3D%22entrytitle%22%20style%3D%22color%3A%20rgb(46%2C%2040%2C%2036)%3B%20fontfamily%3...

16/20

10/10/2015

RemoveCryptoWall3.0virus(FilesEncryptedRansomware)

5. ClickontheActivatefreelicensebuttontobeginthefree30daystrial,andremoveall
themaliciousfilesfromyourcomputer.

data:text/htmlcharset=utf8,%3Ch1%20class%3D%22entrytitle%22%20style%3D%22color%3A%20rgb(46%2C%2040%2C%2036)%3B%20fontfamily%3...

17/20

10/10/2015

RemoveCryptoWall3.0virus(FilesEncryptedRansomware)

Insomecasesyoumayneedtochangeyourwallpaper,anddeletetheharmless
Save_Files,DECRYTP_INSTRUCTIONS.txtandDECRYTP_INSTRUCTIONS.htmlfiles.

B.How(try)torestoreyourfilesencryptedbyCryptoWall
3.0ransomware
Insomecases,itmaybepossibletorecoverpreviousversionsoftheencryptedfilesusing
SystemRestoreorotherrecoverysoftwareusedtoobtainshadowcopiesoffiles.

Option1:RestoreyourfilesencryptedbyCryptoWall3.0
ransomwarewithShadowExplorer
CryptoWall3.0willattempttodeleteallshadowcopieswhenyoufirststartanyexecutableon
yourcomputerafterbecominginfected.Thankfully,theinfectionisnotalwaysabletoremove
data:text/htmlcharset=utf8,%3Ch1%20class%3D%22entrytitle%22%20style%3D%22color%3A%20rgb(46%2C%2040%2C%2036)%3B%20fontfamily%3...

18/20

10/10/2015

RemoveCryptoWall3.0virus(FilesEncryptedRansomware)

theshadowcopies,soyoushouldcontinuetotryrestoringyourfilesusingthismethod.
1. YoucandownloadShadowExplorerfromthebelowlink:
SHADOWEXPLORERDOWNLOADLINK(Thislinkwillopenanewwebpagefrom
whereyoucandownloadShadowExplorer)
2. OnceyouhavedownloadedandinstalledShadowExplorer,youcanfollowthebelowvideo
guideonhowtorestoreyourfileswhileusingthisprogram.

Se produjo un error.
Try watching this video on www.youtube.com, or enable JavaScript if it is disabled in
your browser.

Alternatively,youcanusetheSystemRestoretotrytorecovertheencrypteddocuments.

Option2:RestoreyourfilesencryptedbyCryptoWall3.0
ransomwarewithFileRecoverySoftware
WhenCryptoWall3.0encryptsafileitfirstmakesacopyofit,encryptsthecopy,andthen
deletestheoriginal.Duetothisyoucanusefilerecoverysoftwaresuchas:
Recuva
YoucanfollowthebelowguideonhowtouseRecuva:

data:text/htmlcharset=utf8,%3Ch1%20class%3D%22entrytitle%22%20style%3D%22color%3A%20rgb(46%2C%2040%2C%2036)%3B%20fontfamily%3...

19/20

10/10/2015

RemoveCryptoWall3.0virus(FilesEncryptedRansomware)

EaseUSDataRecoveryWizardFree
RStudio

data:text/htmlcharset=utf8,%3Ch1%20class%3D%22entrytitle%22%20style%3D%22color%3A%20rgb(46%2C%2040%2C%2036)%3B%20fontfamily%3...

20/20