Remover CryptoWall 3.0 e restaurar os arquivos criptografados - Como, Tecnologia e Fórum de Segurança PC |

Remover CryptoWall 3.0 e restaurar os arquivos criptografados

A new and improved variant of the CryptoWall ransomware has been infecting computers worldwide in the past few days. O novo CryptoWall 3.0 uses a localized ransom message and passes traffic to a website where the victims can pay for the decryption key needed to unlock their files through Tor and I2P anonymous networks.

CryptoWall is a file-encrypting type of threat, which once activated on the infected machine encrypts certain files on it and demands a fine of $500 in order to provide the victim with the decryption key. The ransom is to be paid in Bitcoin digital currency in the first 168 horas.

Resumo ameaça

Nome CryptoWall 3.0
Tipo ransomware
Pequena descrição The user’s files are encrypted and unusable.
Os sintomas A ransom note is displayed to the victim.
distribuição Método Via malicious attachments.
Ferramenta de detecção See If Your System Has Been Affected by CryptoWall 3.0


Remoção de Malware Ferramenta

Experiência de usuário Participe do nosso fórum para discuss CryptoWall 3.0.

The New Features of CryptoWall 3.0

New Tor to Web gateways are used by the new version of CryptoWall:,,, and Either one of them redirects the victim to the same web page containing the payment instructions, but the IDs for tracking the payments are unique.

The payment period is extended from five days to a whole week, after which the fee is raised to $1000.

The crooks have created additional files containing information about the payment and the restoring of the encrypted data:

  • HELP_DECRYPT.HTML: uses your web browser to display information about the threat, encryption and payment methods
  • HELP_DECRYPT.PNG: contains details about CryptoWall 3.0
  • HELP_DECRYPT.TXT: the same as the previous one, but in plain text
  • HELP_DECRYPT.URL: uses your current web browser to display the CryptoWall 3.0 Decrypt Service when Windows is loaded

The ransom message displayed by CryptoWall 3.0 lê:

O que aconteceu com seus arquivos?
All of your files were protected by a strong encryption with RSA-2048 using CryptoWall 3.0.
Mais informações sobre as chaves de criptografia usando RSA-2048 pode ser encontrada aqui:

O que isto significa?
Isto significa que a estrutura e os dados dentro de seus arquivos foram irrevogavelmente mudou, você não será capaz de trabalhar com eles, lê-los ou vê-los, é a mesma coisa que perdê-los para sempre, mas com a nossa ajuda, você pode restaurá-los.

Como isso aconteceu?
Especialmente para você, on our server was generated the secret key pair RSA-2048 – público e privado.
Todos os seus arquivos foram criptografados com a chave pública, que foi transferido para o seu computador através da Internet.
Descriptografia de seus arquivos só é possível com a ajuda da chave privada e programa de descriptografar, que é em nosso servidor secreto.
O que eu faço?
ai, se você não tomar as medidas necessárias para o tempo especificado, em seguida, as condições para obter a chave privada será alterado.
Se você realmente valoriza os seus dados, then we suggest you do not waste valuable time searching for other solutions because they do not exist.

Once the file-encryption process is over, the original files are deleted. In case you do not have a backup of your files, you could use reliable software to restore them or part of them from the Windows shadow copies. Below you will find detailed instructions on how to do so.

Connection to I2P Fails

The new version of CryptoWall has been detected by security experts at Microsoft and the French researcher Kafeine, who has reported that the communication with the C&C (Comando e controle) server is encoded with the RC4 algorithm and uses the I2P protocol.

As Kafeine tried to test the sample of the new threat, he received an error message every time he attempted to connect to the proxies. The notification, the researcher received, stated that the I2P website was not available due to various reasons – inability to connect to systems or congested network. The hackers seemed to be ready for cases like this one, because they have provided detailed instructions on how to gain access to the decryption service on the Tor network.

Cryptowall 3.0 New Distribution Methods (setembro 4, 2015)

How is Cryptowall 3.0 dropped onto the system?

Cryptowall ransomware has been around long enough for researchers to gather detailed information about its methods. The ransomware is distributed primarily via emails with .ZIP attachments. The latter contain executable files masqueraded as PDFs. The files in question can be any form of business communication such as:

  • Faturas
  • Purchase orders (POs)
  • Contas
  • Complaints

Once the malicious PDF is launched, CryptoWall will be installed onto the system. The malicious files will be located in one of the two folders %Dados do aplicativo% ou %temp%. Então, the threat will start scanning the system’s drivers to find files to encrypt. All drive letters will be scanned, removal drives, network shares and Dropbox mapping included. Any drive letter on the infected system will be checked for data files.

Here is a list of all the locations where CryptoWall 3.0 may be situated:

  • %temp%
  • C:\[aleatória]\[aleatória].Exe
  • %Dados do aplicativo%
  • %Dados do Programa%
  • %LocalAppData%

Can I Find the Files Encrypted by CryptoWall 3.0?

Files encrypted by CryptoWall 3.0 will be stored together with their paths in the Windows Registry. The subkey location is in the following format:

HKCU\Software\[unique computer ID]\[random ID]

An actual example looks like that:


The process will be repeated for every encrypted file under the mentioned key.

ListCwall can be used as well. It is a tool created by Bleeping Computer to automate the finding and exporting of the encrypted files. The tool can also backup the locked files to another location, in case the user needs to archive them and reformat the PC.

Além disso, here is a list with file extensions which CryptoWall 3.0 seeks to encrypt:

→ .3dm, .3ds, .3fr, .mcmeta, .vfs0, .mpqge, .kdb, .DB0, .dba, .rofl, .hkx, .Barra, .UPK, .o, .iwi, .litemod, .de ativos, .forja, .ltx, .BSA, .apk, .RE4, .sav, .lbf, .SLM, .bik, .epk, .rgss3a, .em seguida, .grande, carteira, .wotreplay, .xxx, .desc, .py, .m3u, .flv, .js, .css, .rb, .png, .jpeg, .TXT, .P7C, .P7B, .p12, .pfx, .estab, .crt, .cer, .o, .X3F, .SRW, .PFE, .ptx, .r3d, .RW2, .RWL, .cru, .raf, .ORF, .NRW, .mrwref, .mef, .erf, .kdc, .dcr, .CR2, .CRW, .baía, .SR2, .SRF, .ganho dia, .3fr, .DNG, .3g2, .3gp, .3por, .7de, .AB4, .ACCDB, .sql, .mp4, .7de, .rar, .m4a, .wma, .avi, .wmv, .csv, .d3dbsp, .fecho eclair, .eles, .soma, .iBank, .t13, .t12, .QDF, .gdb, .imposto, .pkpass, .bc6, .BC7, .PKP, .QIC, .bkf, .SIDN, .são, .mddata, .itl, .ITDB, .icxs, .hvpl, .hplg, .hkdb, .mdbackup, .syncdb, .gho, .caso, .SVG, .mapa, .OMM, .ITM, .sb, .fos, .mov, .vdf, .ztmp, .sis, .sid, .NCF, .cardápio, .traçado, .dmp, .gota, .esm, .vcf, .VTF, .dazip, .fpk, .MLX, .KF, .IWD, .vpk, .tor, .psk, .aro, .w3x, .FSH, .NTL, .arch00, .lvl, .SNX, .cf., .ff, .vpp_pc, .LRF, .m2, .JPE, .jpg, .cdr, .indd, .para, .eps, .pdf, .PDD, .psd, .dbf, .mdf, .WB2, .rtf, .wpd, .dxg, .xf, .dwg, .PST, .ACCDB, .mdb, .pptm, .PPTX, .ppt, .XLK, .xlsb, .xlsm, .xlsx, .xls, .wps, .docm, .docx, .doutor, .odb, .episódio, .odm, .responder, .ods, .odt, .ACCDE, .accdr, .accdt, .mas, .acr, .Aja, .adb

User Behavior and Ransomware. Os golpes de phishing

What we described about the distribution methods so far can mean only one thing – the cyber criminals solely rely on the user’s interaction with malicious spam. The method is known as phishing – a form of social engineering often deployed to spread malware or collect user credentials. This is an exemplary email of how the scam may appear to users:


image Source: Symantec

Cryptowall Precautionary Tips

To bypass malicious infections, avoid downloading archive files such as .fecho eclair, .jarra, .leva, .7de, .msi, and executable/script files such as .com, .Exe, .scr, .bastão, .js, .jse, .vb, .vbe, .wsf, .wsh, .cmd. Always bear in mind that real companies would avoid sending such types of files, unless you had a previous arrangement set.

Além disso, you can use online website rating services such as Norton Safe Web to determine if a website is safe or unsafe to visit. With file-encrypting threats, the best precautionary advice is a very simple one. Back-up your files. Aways think of this, especially when your data is valuable and you keep a lot of business documents on your PC.

You can also check out the general precautionary tips we have on our forum about ransomware, which come full force for CryptoWall 3.0 também.


CryptoWall 3.0 can encrypt files on a network share in case it is mapped as a drive letter. If the network share is not mapped as such, CryptoWall 3.0 will not affect the files located there. To secure open shares, users can allow only writable access to the needed user groups or authorized users. The tip is quite important when it comes to threats such as CryptoWall.

Remover CryptoWall 3.0 e restaurar os arquivos criptografados

Follow the instructions provided below to remove all traces of this ransomware. Keep in mind that the best and most secure way to do that is by using a strong anti-malware program.


Berta Bilbao

Berta é um pesquisador de malware dedicado, sonhando para um espaço cibernético mais seguro. Seu fascínio com a segurança de TI começou há alguns anos atrás, quando um malware bloqueado la fora de seu próprio computador.

mais Posts

51 Comentários

  1. AvatarGreg

    great information! I was infected with theCRYPTOWALL 3.0virus recently, it was downloaded from my need to download Google Chrome and the latest Chromecast. It continued to download malware which was very disturbing. If you have heard about this happening when Google Chrome was installed, would you please pass it on to all of your followers.

    thank you and best regards!


    1. AvatarAnticryptowall

      Bonjour tout le monde voici une solution, comment protéger vos fichier et documents de ce virus CryptoWall

      1. AvatarMilena Dimitrova

        Hi Anticryptowall,

        Are you sure that your method works?

        1. AvatarAnticryptowall

          Oi Milena Dimitrova
          i did that experience so many times on image disks by various viruses especially by crypto viruses and The result was always positive

          1. AvatarMilena Dimitrova

            Oi de novo,

            What about CryptoWall 3.0, em particular?

  2. Avatarfrancis

    my boss got hit and his memory stick was encrypted. he purchased a new memory stick from sandisk that came with a one year subscription toRescuePROand he was prompted to recover files-he inserted his infected stick and the software restored his files onto his new stick and now his files are in a safe VAULT on the new stick.

  3. AvatarIna

    please let me know if there is some solution. I was also caught by this while trying to upgrade Chrome. I am in desperate need of a solution as I don’t have any back ups. Every Microsoft file is infected and decrypted

    1. AvatarArthur

      me too. all my files can’t be open.

      1. AvatarDirk

        With me also and I also do not restore because this feature is not turned on my computer.
        Please someone?

  4. Avatartony

    please helppppppppp all my files were protected by a strong encryption with RSA-2048.

    1. AvatarSertab (pós autor)

      Olá, Tony!

      CryptoWall is indeed a nightmare and we are sorry to read that you have been affected by it. RSA algorithm has been deployed by many ransomware threats. You can be sure that many users and security specialists have been trying to break the RSA-2048 encryption. More about the RSA-2048 encryption key that has been targeting computers find here:

      RSA-2048 can be broken if someone finds a way to create collisions that inherently reduce the expected number of combinations to crack the cipher. Being a cipher, the RSA-2048 algorithm can be cracked by brute force. Brute force cracking can be described as a trial-and-error technique employed by programs to decipher encrypted data like passwords and DES (Data Encryption Standard) keys via extensive effort instead of intellectual force.

      RSA encryption is a type of language that alters the normal code of the file with a unique key. This key can be decrypted via specific software, but it requires a powerful machine. More on the RSA encryption topic and how to remove CryptoWall manually:

      Finalmente, our research team has compiled several easy steps to follow to protect your files from ransomware threats:

      Além disso, if you want to learn more about the methods employed by CryptoWall and the cyber criminals behind it, you can refer to this article:

  5. AvatarVincent Laurent

    obrigado, I removed the virus with SpyHunter but my files are still corrupted and i cannot open them. Por favor me ajude… how to repair them????

  6. AvatarITResearcher


  7. AvatarSteve

    With original file, encrypt file and public key used to encrypt file, can you decipher other files that used that public key?

  8. Avatarkewin nielsen

    jeg fik hele mit data drev krypteret af cryptowall 3.0 igennem ransomware(conhost) og den havde enda kryptere min gendanelsespunkter og backup den eneste måde jeg fik mine filere igen var ved hjælp af recuva da cryptowall sleter original filen og overskriver dem med en krypteret

  9. Avatarjoao

    I have files that cannot be opened too.
    I am going to pay the ransom today or tomorrow.
    I have heard that if we pay the ransom the unblock all the files for sure (99% certo).
    They don’t want the files. They just want the money.
    I try everything to unblock my files. Even new karpersky software. Nothing works.

    Did some one have the same experience?
    Did someone pay the ransom before?
    O que aconteceu?

    I will leave my experience here soon.

    1. AvatarMilena Dimitrova

      Hi joao,

      Em primeiro lugar, sorry to hear you’ve suffered a CryptoWall 3.0 ataque!
      Can you please start a topic in our forum We will try and help you with whatever we can. The forums are more convenient for such discussions :)

      Fique ligado,

      a equipe STF

      1. Avatarkate

        Hi joao,
        Did you pay it? What the result?
        I have the same problem but i’m trying to solve it..

    2. AvatarRichard

      Hola Joao, trabajo como técnico en una empresa y unos de los gerentes, fue ataco por este virus, me gustaría saber si pudiste recuperar la información luego de realizar el pago, y que cantidad de información, pudieron recuperar?

    3. Avatarsham

      have you paid them >?? and recovered your files or not ?

  10. AvatarDaniel fornerino

    boa tarde, mi caso es que el equipo fue infectado con el virus, formatee el equipo pero toda la información abre. tengo informacion de vida o muerte y me urge recuperarla. alguien que me pueda colaborar. por favor

    1. AvatarbadGift

      si può restituire il sistema indietro, ma è possibile solo in caso che abbia fato il backup prima.
      Se no- puoì scaricare quelche programma di ricuperazione come recuva ,getdatabach o diskdrill..però, purtroppo tali software non recuperanno il 100% ,solo i dati eliminati recentemente . ecco uno dei tali programma
      forse ti aiuti,

  11. AvatarVencislav Krustev

    Olá, Fornerino

    In case you have been infected with Cryptowall, it is important to know that it uses a VERY strong algorhitm, called RSA-2048. Its decryption may take years to complete. We advise you to try restoring your files by going to a professional data recovery expert or attempting to use on of the aftermentioned tools:

    Kaspersky Rector Decryptor

    This decryption tool is very simple to use and

    EaseUS Data Recovery Wizard grátis

    Here is a free program which uses different methods to search through your computer and recover files that are even deleted beyond all saving. It is no guarantee that it will work, but some say they have recovered at least 10 percent of their files and some other files were partially broken. So in case you want to try it out, here is the download link for the tool:

    Explorador sombra

    You may as well try running Shadow Explorer in case you have File History or backup enabled. You can download it from here, but note that TeslaCrypt may as well have malicious scripts that delete any backups and previous file versions. Here is the download link for Shadow Explorer:

    Look for the latest version and you may as well download the portable one since it saves you time.

    This is as far as I can suggest, try it and reply whether or not you have been successful. Novamente, there is absolutely no guarantee that any of the methods are working, but we are talking about encrypted files here, after all so it may be worth the try.

  12. AvatarSham

    My all files are encrypted with RSA-4096.

    I can not open any file.They are asking for 500 USD for decryption key. Please anybody can help me to decrypt my files as i don’t have any backup restore.

    1. AvatarMilena Dimitrova

      Hi Sham,

      Primeiro, can you please tell me how you got to know that RSA-4096 was used in your case?

      1. AvatarSERAS

        Slt Milena!
        Comment tu vas? j’aimerais avoir des notions sur le cryptage, comment cela se passe, avoir un cas pratique!
        Agradecemos antecipadamente! je laisse mon mail ou si je peux avoir le tien cela me sera d’une très grande utilité

  13. Avatarsham

    hi Milena..
    I found a ransomware file in my every folder

    1. AvatarMilena Dimitrova

      Hi Sham, looking into your case as we speak!

      1. Avatarsham

        Caro Milena,

        Waiting for your help….your earlier response will be favorable.

        1. AvatarMilena Dimitrova

          Hi Sham,

          A topic has been started in our forum about the particular encryption:!-my-files-were-encrypted-with-strong-rsa-4096-encryption!/msg679/#msg679

          Please provide us with the following information there (it’s easier to discuss in the forum than here) – your system, exact file extensions added to the encrypted files, notas de resgate, etc. Além disso, have you removed the Trojan that has dropped the ransomware?

  14. AvatarMilena Dimitrova

    Hello SERAS,

    I am fine but really sorry to see so many people falling victims to ransomware. You can send us information about your ransomware case on

  15. AvatarJorge

    Todos mis archivos está con extensión vvv no sé cómo desencriptar los estoy muy angustiado por favor ayuda ya elimine Cryptowall tengo encriptados toda mi información de 20 años de trabajo por favor ayuda

    1. AvatarMilena Dimitrova

      oi Jorge,

      I am deeply sorry to let you know that without a clean copy of your files, you most likely will not be able to restore your information. You can try using TeslaDecoder and Rakhnidecryptor. Contudo, reports indicate that these decoders won’t help with the .vvv extension that belongs to TeslaCrypt ransomware:

      Have you removed the ransomware with an anti-malware program?

  16. AvatarWalter

    E’ successo anche a me. Il problema eche ogni file ha un’estensione diversa 0A/0A1/OMF ECC
    Si puofare qualcosa?

  17. Avatardbgn

    Oi, I also caught this virus but it was only too late that I realized it and now all my files are encrypted with RSA-2048. The file extensions were changed and it seems that the extension for each file is different from any other and none are the same. Some of the file extensions I see now are .p468t,.16G, .n7r0, .us7m, .25sq, .xo3r4 and so many more. eu preciso de ajuda.

    1. AvatarVencislav Krustev

      Hello @dbgn
      This is typical for Ransomware infections such as CTB Locker and CryptoWall 4.0. In order for me to be able to adequately provide you with assistance I would like you to send me a snip or a screenshot of any ransom message that you may see. It may be a .txt file on your desktop or a picture.

      Use this Forum Topic To Attach A Screenshot In Your Reply

      1. Avatarwalter

        Olá , I invierei a file , but I do not knowhow to attach it to this message

  18. Avatarcharles

    hello vencislav
    mz laptop is infected with thee teslacrzpt virus and all mz files are encrzpted with RSA-4096 key
    could zou help me_ please

  19. AvatarTer

    Oi, Friends! My Pc was infected, i do eliminate ransomware using spyhunter, but muy files stay encrypted with .MICRO extention. ¿How i can decrypt the files? obrigado!!

    1. AvatarVencislav Krustev

      Hello Ter,

      You have been infected with a variant of TeslaCrypt. For more information check the following article:

      Remove TeslaCrypt and Restore .micro Encrypted Files

      You may also send files so that we can try and help to decrypt them. Here is the address:

      We will disclose your files and send them back to you if successfully decrypted. Bear in mind that since we receive a lot of files it may take some time.

  20. AvatarShihas

    oi Milena , one of our system got infected with this cryptowall 3 and encrypted the files with .micro extension. I was able to remove the malware but after two days, one of our Network attached storage got affected as well. Now I am wondering how that is possible ? I thought only personal files got affected by this script.

    1. AvatarMilena Dimitrova

      Hello Shihas,

      Ransomware is often used in attacks on companies. The bad news is there’s still no solution for .micro encrypted files. We assure you however that security experts (us included) are doing their best to fight this threat and beat its encryption.

  21. AvatarNani

    i was installed a software .after my .jpg,.mp4 files are changed into a .micro extension .pls help to how to get my old file format .

    1. AvatarMilena Dimitrova

      Hi Nani,

      Infelizmente, you have been attacked by the latest version of TeslaCrypt ransomware. We are still trying to figure out how to decrypt files encrypted by it. Once we find a solution, we will share it.

      Have you removed the ransomware from the infected computer?

  22. Avatarraluca

    Olá! My laptop is infected with Cryptowall3.0. I’ve cleaned it, but all my files are encrypted. Any news on how to dectrypt them?

  23. AvatarYann Bessin

    Il est à noter qu’Europol a pris conscience du problème des ransomwares et propose dorénavant un portail en ligne pour aider les victimes (

    1. SensorsTechForumSensorsTechForum

      Merci beaucoup :)

  24. AvatarDennis

    I have removed the ransomware but now i have encrypted files ending with .albigec. Does anybody now how to decrypt the files? (Cryptowall 3.0)

  25. AvatarSamiya

    My files are encrypted with RSA2048 algorithm ransomware. I need a decryptor for this immediately. Por favor ajude

  26. AvatarNaveen Noronha


    My files were encrypted way back in 2015 ( by Cryptowall 3.0) I still have the files with me and the instructions to pay up and retrieve my files. Is there any way to retrieve these files through free or paid means?

    1. AvatarMilena Dimitrova

      Hi Naveen,

      Infelizmente, this ransomware case remains unsolved, as no official decrypter has been released to this day.


Leave a Reply to Sertab Cancelar resposta

seu endereço de e-mail não será publicado. Campos obrigatórios são marcados *

limite de tempo está esgotado. Recarregue CAPTCHA.