How to remove CryptoWall virus and restore your files

Last updated on September 12th, 2014

CryptoWall is another nasty ransomware virus that infects Windows Operating systems and it is the updated version of CryptoDefense ransomware virus. As a good 'child', it keeps its original abilities, as well as some new ones. CryptoWall encrypts all your files and keeps them locked and there is no way to use them until you pay the ransom asked. CryptoWall can encrypt all known file types (documents, PDF, photographs, videos and more) on all connected storage drives or locations. That means that it can infect (encrypt) all the files on the local or network drive(s), even in cloud storage systems (e.g. Google Drive, Dropbox, Box, etc.). Cryptowall does so, by adding strong encryption (RSA 2048) on each file. In simple words, you can't open – or work with – your files anymore.

After Cryptowall infection, the virus creates several files on every infected folder named DECRYPT_INSTRUCTION.txt, DECRYPT_INSTRUCTION.html, and DECRYPT_INSTRUCTION.url which contain notes on how to pay the ransom in order to decrypt the encrypted files by following a specific procedure using Tor Internet Browser.

The Cryptowall's ransom is set to 500$ (in BitCoins), if you pay it in the deadline period, otherwise the ransom will be increased at 1000$. After payment, hackers will sent you your private decryption key that can – supposedly – decrypt your files. The issue here is that even if you pay the ransom, you can't be sure that your files will be restored. The only guarantee is that your money will go to some hacker that will keep doing the same thing to others victims.




The full CryptoWall information message is as follows:


What happened to your files ?
All of your files were protected by a strong encryption with RSA-2048 using CryptoWall.
More information about the encryption keys using RSA-2048 can be found here:

What does this mean ?
This means that the structure and data within your files have been irrevocably changed, you will not be able to work with them, read them or see them,
it is the same thing as losing them forever, but with our help, you can restore them.

How did this happen ?
Especially for you, on our server was generated the secret key pair RSA-2048 – public and private.
All your files were encrypted with the public key, which has been transferred to your computer via the Internet.
Decrypting of your files is only possible with the help of the private key and decrypt program, which is on our secret server.

What do I do ?
Alas, if you do not take the necessary measures for the specified time then the conditions for obtaining the private key will be changed.
If you really value your data, then we suggest you do not waste valuable time searching for other solutions because they do not exist.

For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below:

If for some reasons the addresses are not available, follow these steps:
1.Download and install tor-browser:
2.After a successful installation, run the browser and wait for initialization.
3.Type in the address bar: kpa2i8ycr9jxqwilp.onion/xxxx
4.Follow the instructions on the site.

Your personal page:
Your personal page (using TOR): kpa2i8ycr9jxqwilp.onion/xxxx
Your personal identification number (if you open the site (or TOR 's) directly): xxxx


How to Prevent CryptoWall Infection.

  • Precaution is always the safest way to keep your PC unharmed.
  • You must be very careful whenever you open an unknown e-mail, especially if such an e-mail contains a fake notification (e.g. 'UPS Exception Notification') or .EXE, .SCR, or .ZIP file attachments.
  • You must be careful in scam sites that prompt you to install software that you supposedly need and DO NOT INSTALL such software.
  • The best way to deal with all type of malware infections is to always have a clean and as recent as possible backup of your important files stored in another OFFLINE (unplugged) medium (e.g. External USB HDD, DVD ROM, etc.). If you do that, you can first disinfect your computer and then restore all your files back from the clean backup.
    Info: For this task I use a reliable smart and FREE (for personal use) backup software called "SyncBackFree". A detailed article on how to use SyncBackFree to backup your important files can be found here.
  • Corporate network technicians can use a disk imaging software (like "Acronis True Image") to take image backups of Workstations (or Servers) state at scheduled times. By doing that, the restore process is much easier and faster and is only limited from the storage you have available from the imaging process.


How to get your files back after Cryptowall infection.

Unfortunately, a FREE decryption tool or method  to decrypt Cryptowall encrypted files DOES NOT EXIST (until the day this article was written – at the end of June 2014). So the only options you have to get your files back are the following:

  1. The first option is to pay the ransom*. After that, you will receive from the criminals your private decryption tool to decrypt your files.
    * Note:  If you decide to pay the ransom you have to do that at your own risk. Criminals are not the most trustworthy people in the world.
  2. The second option is to disinfect your computer and then to restore your files from a clean backup (in case you have one).
  3. Finally, if you have a Windows 8, 7 or Vista OS and the "System Restore" feature was not disabled on your system (e.g. after a virus attack) then after disinfecting your system you can try to restore your files in previous versions from "Shadow Copies". (See below on this article on how to do that).


How to remove Cryptowall virus and restore your files from Shadow Copies.

Part 1. How to remove Cryptowall infection.

Attention : If you want to remove Cryptowall infection from your computer, you must realize that your files will remain encrypted, even if you disinfect your computer from this nasty malware.


YOU HAVE A CLEAN BACKUP COPY OF YOUR FILES STORED IN A DIFFERENT PLACE (like an unplugged portable hard disk drive.)





So, if you have taken your final decision, then proceed, first to remove Cryptowall ransomware infection from your computer and then to try and restore your files by following the procedure below:


Step 1: Start your computer in "Safe Mode with Networking"

To do this,

1. Shut down your computer.

2. Start up your computer (Power On) and, as your computer is booting up, press the "F8" key before the Windows logo appears.

3. Using your keyboard arrows, select the "Safe Mode with Networking" option and press "Enter".


Step 2. Stop and delete Cryptowall running processes with RogueKiller.

RogueKiller is an anti-malware program designed to detect, stop & remove generic malwares and some advanced threats such as rootkits, rogues, worms, etc.

1. Download and save "RogueKiller" utility on your computer'* (e.g. your Desktop)

Notice*: Download version x86 or X64 according to your operating system's version. To find your operating system's version, "Right Click" on your computer icon, choose "Properties" and look at "System Type" section.


2. Double Click to run RogueKiller.


3. Wait until the pre-scan is completed and then read and "Accept" the license terms.


4. Press the "Scan" button to scan your computer for malicious threats and malicious startup entries.



5. Finally, when the full scan is completed, press the "Delete" button to remove all malicious items found.


6. Close "RogueKiller" and continue to the next step.


Step 3. Remove Cryptowall infection with Malwarebytes Anti-Malware Free.

Download and install one of the most reliable FREE anti malware programs today to clean your computer from remaining malicious threats. If you want to stay constantly protected from malware threats, existing and future ones, we recommend that you install Malwarebytes Anti-Malware Premium:

Malwarebytes™ Protection
Removes Spyware, Adware & Malware.
Start Your Free Download Now!

Quick download & Installation instructions:

  • After you click the above link, press at the "Start My Free 14-Trial" option to start your download.


  • To install the FREE version of this amazing product, uncheck the "Enable free Trial of Malwarebytes Anti-Malware Premium" option at the last installation screen.


Scan & Clean your computer with Malwarebytes Anti-Malware.

1. Run "Malwarebytes Anti-Malware" and allow the program to update to its latest version and malicious database if needed.


2. When the update process is completed, press the "Scan Now" button to start scanning your system for malware and unwanted programs.


3. Now wait until Malwarebytes Anti-Malware finishes scanning your computer for malware.


4. When the scan has completed, first press the "Quarantine All" button to remove all threats found.


5. Wait until Malwarebytes Anti-Malware removes all infections from your system and then restart your computer (if required from the program) to completely remove all active threats.


6. After the system restarts, run Malwarebytes' Anti-Malware again to verify that no other threats remain in your system.

Part 2. How to restore Cryptowall encrypted files from Shadow copies.

After you have disinfected your computer from Cryptowall  virus, then it is time to try to restore your files back to their state prior to the infection. There are two (2) methods to do that:

Method 1: Restore Cryptowall encrypted files using Windows "Restore Previous versions" feature.

Method 2: Restore Cryptowall encrypted files using 'Shadow Explorer' utility.

Attention: This procedure works only on latest operating systems (Windows 8, 7 & Vista) and only if the System Restore feature wasn't previously disabled on the infected computer.

Method 1: How to restore Cryptowall encrypted files using "Previous versions" feature.

1. Navigate to the folder or the file that you want to restore in a previous state and right-click on it.

2. From the drop-down menu select "Restore Previous Versions". *

resore previous versions

3. Then choose a particular version of folder or file and then press the:

  • "Open" button to view the contents of that folder/file.
  • "Copy" to copy this folder/file to another location on your computer (e.g. your external hard drive).
  • "Restore" to restore the folder file to the same location and replace the existing one. 


previous folder version

Method 2: How to restore Cryptowall encrypted files using "Shadow Explorer" utility.

ShadowExplorer, is a free replacement for the Previous Versions feature of Microsoft Windows Vista, 7, & 8 OS and you can use it to restore lost or damaged files from Shadow Copies.

1. Download ShadowExplorer utility from here. (You can either download the ShadowExplorer installer or the Portable version of the program).

2. Run ShadowExplorer utility and then select the date that you want to restore the shadow copy of your folder/files.


3. Now navigate to the folder/file that you want to restore to its previous version, right-click on it and select "Export".

ShadowExplorer export[5]

4. Finally specify where the shadow copy of your folder/file will be exported/saved (e.g. your Desktop) and press "OK".

shadow explorer export location


Good luck!.

If this article was useful for you, please consider supporting us by making a donation. Even $1 can a make a huge difference for us in our effort to continue to help others while keeping this site free: