What is CryptoWall Ransomware?
CryptoWall is the name of a malicious program that is designed to encrypt victim’s files, so that its developers could demand ransom for their retrieval. The ransomware aims for the most popular file types and is able to infiltrate any version of Windows, whether it is Windows XP, Windows Vista, Windows 7, Windows 8, or Windows 10. The detected files will be encrypted with the RSA ciphering, making these files inaccessible. With the encryption of the last file CryptoWall displays a window with the note that suggests the ransom details. It offers to go to the CryptoWall Decryption Service to make a payment and get the decryption utility. The starting amount of the ransom accounts for 500 USD, which doubles after a week. The money should be transferred in Bitcoins to a Bitcoin address which is unique for each user.
Versions and Updates of CryptoWall
CryptoWall 2.0: The updated version of CryptoWall was released in October 2014, which was almost similar to the previous version with some minor changes. The developers changed the type of encryption to RSA-2048, introduced the unique BitCoin addresses for each user, started to use Web-to-TOR gateways and began to delete the original versions of encrypted files.
CryptoWall 3.0: In this version, that was released in January 2015, the method of spreading was changed. From now on the ransomware is distributed via exploit kits, making it even more dangerous. The files encrypted by CryptoWall 3.0 will have an extension altered to .aaa
CryptoWall 4.0: At the moment this version is the latest one. CryptoWall 4.0 has got the standalone name of Help Your Files ransomware. The features of this update include the increased ransom sum of $700, altered instruction files, and now the names of the encrypted files change to unique.
How CryptoWall Ransomware got installed on your computer
As the researches reveal, CryptoWall land on the systems brought by spam messages and corrupted downloads offering to fix system issues or update software. In order to keep your system out of the menace, be cautious while opening email attachments. Usually these attachments are of ZIP format and include PDF, which once opened initiate the installation of CryptoWall. Cybercriminals disguise their messages as business or official ones, so that user would mistake them for real ones. In addition to it, we recommend to avoid p2p networks or, at least, scan the files downloaded from them with antimalware/antivirus programs.
Symptoms of CryptoWall Ransomware infection
It’s difficult not to notice ransomware, since it often has one of the processes responsible for displaying a notification message. This window blocks the screen leaving the user minimum alternatives. Besides, some files will be inaccessible, as in many cases ransomware encrypts them to exasperate the scaring effect.
How to remove CryptoWall Ransomware?
To make sure that the threat won’t appear again, you need to delete CryptoWall Ransomware completely. For this you need to remove the files and registry entries of the ransomware. We should warn you that performing some of the steps may require above-average skills, so if you don’t feel experienced enough, you may apply to automatic removal tool.
Performing an antimalware scan with Norton would automatically search out and delete all elements related to CryptoWall Ransomware. It is not only the easiest way to eliminate CryptoWall Ransomware, but also the safest and the most assuring one.
Steps of CryptoWall Ransomware manual removal
Restart Windows in Safe Mode
For Windows 7 and Vista:
- Restart the system
- While computer is rebooting press F8 several times
- In the appeared list of options choose Safe Mode
For Windows 8 and 8.1:
- Restart the system
- While computer is rebooting press F8 several times
- In the appeared list of options choose Safe Mode
For Windows XP:
- Restart the system
- While computer is rebooting press F8 several times
- In the appeared list of options choose Safe Mode
For Windows 10:
- In the Start menu click on the power button
- Hold Shift and choose Restart
- Choose Troubleshoot
- In the Advanced Options choose Startup Settings
- Click Restart
- Select Enter Safe Mode With Networking
Delete files and registry entries added by CryptoWall Ransomware
Now you will be able to reach the needed functions and files. For eliminating the ransomware activity, you need to find all of the following items and delete them.
Remove CryptoWall Ransomware files and folders:
%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\a2f10867.exe
onewindow1s.jpg
11a2c84.exe
%SystemDrive%\22bb2aa7\22bb2aa7.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\Windows\Start Menu\Programs\Startup\HELP_DECRYPT.PNG
%ALLUSERSPROFILE%\Application Data\Microsoft\Windows\Start Menu\Programs\Startup\HELP_DECRYPT.HTML
%ALLUSERSPROFILE%\Application Data\Microsoft\Windows\Start Menu\Programs\Startup\HELP_DECRYPT.TXT
%ALLUSERSPROFILE%\Application Data\Microsoft\Windows\Start Menu\Programs\Startup\HELP_DECRYPT.url
%APPDATA%\sxstaacroic.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\Windows\Start Menu\Programs\Startup\HELP_YOUR_FILES.PNG
%ALLUSERSPROFILE%\Application Data\Microsoft\Windows\Start Menu\Programs\Startup\HELP_YOUR_FILES.TXT
%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\file.exe
%APPDATA%\deyct-a.exe 348,160 ce57a4f528ebb078f9bba3e72dc953f1
%SystemDrive%\43894dc\43894dc.exe
%APPDATA%\ivsposkhf2.exe
DECRYPT_INSTRUCTION.html
DECRYPT_INSTRUCTION.url
DECRYPT_INSTRUCTION.txt
Remove CryptoWall Ransomware registry entries:
HKEY_CURRENT_USER\Software\\CRYPTLIST
HKEY_CURRENT_USER\Software\\\
Restore the files encrypted by CryptoWall Ransomware
Use the decrypting tool
Unfortunately, currently the tool able to decrypt the files infected by Cryptowall ransomware is not released yet. You may try applying to the methods described below, however, they might not work with the latest versions of CryptoWall.
Restore the system
- Initiate the search for ‘system restore‘
- Click on the result
- Choose the date before the infection appearance
- Follow the on-screen instructions
Roll the files back to the previous version
- Right-click the file and choose Properties
- Open the Previous Version tab
- Select the latest version and click Copy
- Click Restore
