Please help me urgently, Because My all files are encrypted by unknown virus named, 'CryptoWall encryption'.
I attached one screenshot, which is provided by this virus.
-
1security.stackexchange.com/questions/80861/…– magicandre1981Feb 20, 2016 at 7:41
-
Tough luck mate... As far as I know ransomware like this one and ransom32 have no way of fixing. You would probably be able to remove the message but to decrypt all your files very much doubt it. Many may say pay the ransom however I heard sometimes it doesn't work so 50%– ss4566654768Feb 20, 2016 at 9:28
-
3You can't. Your options are to either pay (please don't) or restore from a backup– RamhoundFeb 20, 2016 at 13:40
-
2Yes Paying is a big risk not only may you not get your data back or have a 50% chance of paying even working. Paying gives the people that Encrypted your files access to then in a lot of cases ive read online.– NetworkKingPinMar 1, 2016 at 6:38
-
@NetworkKingPin - Provide your sources for that claim. The people doing this could care less about the data. All malware has a purpose. The purpose of CryptoWall is well known.– RamhoundMar 30, 2016 at 21:08
Add a comment
|
1 Answer
You're stuck. There is not yet a known way to reverse CryptoWall. Asymmetric-key cryptography means that one key (the "public key") can encrypt data, making it readable only by the holder of the other part (the "private key").
You should restore from backups, if you have them. Make sure that your antivirus program has cleaned the infection before connecting the backup medium, or you risk getting those encrypted too.
Paying will almost certainly work, but doing that would support their business, so please don't.
If the encryption didn't finish completely, there might be fragments of your unencrypted data still on the disk. If you had Windows backup on, shadow copies might still be around, in which case you can right-click folders and choose Restore previous versions to get at the deleted original files. You might also try third-party file recovery programs like Recuva. If you want to try that, stop using the affected machine, install the recovery tool on a clean computer, and connect the affected hard drive to that new one. That way you don't risk overwriting data by installing the tool.
In the future, keep frequent backups. Make sure that the backed-up data is not accessible from the live machine so it's not affected if the machine is compromised.
