HELP_DECRYPT

HELP_DECRYPT is a set of files that are left behind after your computer is infected by the Cryptowall 3.0 ransomware. Needless to say, you ought to remove this ransomware along with the HELP_DECRYPT files, because this infection will wreak havoc on your computer. This ransomware was developed with the intention of infecting as many computers as possible and encrypt certain file formats that are most commonly used to store personal information. After encrypting these kinds of files, Cryptowall 3.0 generates three HELP_DECRYPT files that contain instructions on how to pay the ransom, and therefore get the promised decryption key. However, from the very outset we must warn you that you may never receive the decryption tool. We recommend that you remove this infection using an anti-malware program and try getting a third-party decryption tool to try and restore your files. Please read this more detailed description below for more information.

It is very difficult to pin point the exact sources where ransomware comes from. Cryptowall 3.0 is no exception in this case. We have received unverified information that this infection may be distributed with the help of phishing emails. These kinds of emails are made to appear as if they come from legitimate legal entities or an actual person. Phishing emails try to trick you into clicking a link inside the email that will redirect you to a fraudulent website that may contain Cryptowall 3.0. Alternatively, an email may contain infected attachments, such as a Word document with enabled macros or a plain ZIP archive file. Of course, its developers may employ different techniques as well. However, this scenario is the most likely one, since most ransomware is distributed in this manner.

Cryptowall 3.0 is similar to the 2.0 version as the dropper file is encrypted with a custom algorithm three times. But that is as far as their similarities go. Furthermore, this newer 3.0 version does not have three functions that were present in the previous version, namely Switching between 32 and 64 bit operation, employing multiple exploits in the dropper, Anti-Vm check to prevent running in virtual environment. But these are minor changes nonetheless.

Once your computer becomes infected with Cryptowall 3.0, it will scan it for personal files, such as .doc, .docx, .pdf, .jpg, and so on. This ransomware encrypts all such files using the RSA encryption algorithm. After the files have been encrypted the infection will leave the aforementioned three files called HELP_DECRYPT. However, the file formats differ. One file is in the .txt format, the second one is in .png, and the last one is .html. All of the HELP_DECRYPT files contain the same information and instructions on how to purchase the decryption key that costs a whopping $500 USD worth of Bitcoins. The instructions are based on the IP addresses location and the language is selected accordingly. As previously sated, you should not pay the ransom, because there are no guaranties that you will receive the decryption tool.

The main visual difference between Cryptowall 3.0 and 2.0 is that the latest version features the HELP_DECRYPT files that contain instructions on how to play the ransom. These files are a clear indication that your files were infected and your computer will be littered with them as each folder containing an encrypted file will feature HELP_DECRYPT files. We highly recommend that you first remove this infection using a antimalware tool, such as SpyHunter, and then try obtaining a third-party decryption tool. However, there are no guaranties that your files will be recovered.

Remove the ransomware

1. Launch the browser.
2. Enter hwww.pcthreat.com/download-sph in the address bar.
3. Download and initiate the installer.
4. Run the program.
5. Select and run the full system scan.
6. Click Fix Threats.
7. Done.