There are two tell-tale signs that indicate CryptoWall has infected your computer.
- When attempting to open certain files, such as .doc, .xls or .pdf, for example, the files are launched with the correct program; however, data may be garbled or not properly displayed. Additionally, an error message may be accompanied when trying to open infected files.
- The most common indication will be the appearance of three files at the root of every directory that contains files that were encrypted by CryptoWall.
- DECRYPT_INSTRUCTION.txt
- DECRYPT_INSTRUCTION.html
- DECRYPT_INSTRUCTION.url
After the timer has reached zero, the caption will change. The new amount requested will double to $1,000, and the timer will provide a cutoff date and time. Usually, the time frame is about one week, and it will tell you that if payment is not received before the cutoff time, the remote server housing the private key and decryption application to decrypt your files will be automatically deleted, making your files unrecoverable.
After confirming that your computer is infected, you have to decide if you want to pay the ransom to get your data back, or if you don't. If you decide to pay the ransom, you have to do so in Bitcoins.
If you don't pay the ransom, you can attempt to recover your files if you have some sort of backup in place. This may or may not work. We recommend working with a skilled IT Technician to help you with this. How can I protect my computers from the CryptoWall virus?





