The RSA-2048 Crypto Ransom Virus has devastated me, I tried the backup method, the previous version, the Shadow Explorer, it deleted all my restore points, Its took out 5 HDs and my USB pen that happened to be plugged in, everything is encrypted, all my kids pictures and videos, spreadsheets, PDF's, Music and more. I need to know if I should pay these bastards? or is it possible to decrypt? I have attached a picture of the DECRYPT_INSTRUCTION.HTML. I also tried TeslaDecoder with no luck. Can someone please help? I also can send you one of my encrypted files.

Just a picture not a html link


closed as off-topic by fgrieu, Artjom B., K.G., Gilles 'SO- stop being evil', yyyyyyy Dec 12 '15 at 14:31

  • This question does not appear to be about cryptography within the scope defined in the help center.
If this question can be reworded to fit the rules in the help center, please edit the question.

  • 3
    $\begingroup$ In the short term, restore data files (not programs) from backups to a clean computer (do not bring the backups to the infected one). Or hope the perpetrator made a silly mistake, and someone knowledgeable and with a lot of time will find it, and make a workaround available (that happens for some cryptoransomware). In the long term, understand and master any tool you use; that's valid for computers and milling machines alike. Sorry, this is off-topic. $\endgroup$ – fgrieu Dec 12 '15 at 11:43
  • 2
    $\begingroup$ I'm voting to close this question as off-topic because it's about recovering from malware, not about cryptography. $\endgroup$ – Gilles 'SO- stop being evil' Dec 12 '15 at 13:46

First off, I am sorry to hear about your circumstances. Unfortunately, the virus that you caught seems to be CryptoWall 3.0 or at least a variation of it. Therefore I am bringing bad news. As stated here it is not possible to decrypt or recover the files without paying these [insert swearword].

This is mainly through the nature of the encryption algorithm used, as the key used to decrypt your files is only known to the creators/distributors of the virus.

For the future, make sure to have backups of all your data on a drive that is not connected to your computer and most importantly NEVER click on links or open attachments from E-Mails when you can't 100% verify the senders integrity.


Not the answer you're looking for? Browse other questions tagged or ask your own question.