What is DECRYPT_INSTRUCTIONS.html? Should I remove it?

by Ugnius Kiguolis - -

What does DECRYPT_INSTRUCTIONS.html file suggest?

Encountering DECRYPT_INSTRUCTIONS.html file is certainly not good news. It signals that your computer and personal files have been victimized by CryptoWall, alternatively known as CryptoLocker, file-encrypting threat. This threat rose in 2013. Along with such threats as Locky and Cerber, emerging in later years, it has managed to spread terror globally. Due to the usage of elaborate asymmetric and symmetric, specifically, AES-256 and RSA-2048, encryption technology, it managed to encode personal files of natural and legal persons. Likewise, throughout its existence, it has made over $325 million profit. Luckily, its activity fell in the past months which triggered speculations that the authors decided to end the project. However, such naive thoughts should not persuade you into thinking that CryptoWall is no longer in the cyber space. Unfortunately, it gave inspiration for other hackers. So is it possible to terminate CryptoWall simply by deleting DECRYPT_INSTRUCTIONS.html file?

The malware contains a complex source code and initiates commands which modify registry entries. While the malware is present on the system, it also launches the command to delete shadow volume copies which makes matters much worse. Since there are multiple versions of CryptoWall, you might notice that your data contains different file extensions: if it is Crypt0L0cker, then it appends .enc file extension, while the original version attached .locked file extension. After completing the encryption process, it redirects users to DECRYPT_INSTRUCTIONS.html web page. In order to terrify victims even more, the analogous, DECRYPT_INSTRUCTIONS.txt, file is placed on the desktop to remind of the hopeless situation they are in. In these instructions, the authors provide a brief FAQ guide for users who have been struck with crypto-malware for the first time. The guide also contains instructions how to purchase bitcoins and transfer them to a respective address controlled by racketeers. The file also contains an incorporated clock which counts expiration time. After the indicated time period ends, the files are said to be deleted. Since Cryptowall has shape-shifted into multiple versions throughout its existence, Crypt0L0cker and Torrentlocker have also been using the same file for instructing victims.

Distributing CryptoWall and DECRYPT_INSTRUCTIONS.html

All versions up to CryptoWall 5.1 have been using similar hijack techniques. Unfortunately, most profitable of them remains the transmission of the infection via spam emails. The malware is disguised as a .doc file in a .zip folder. Specifically, the virus asks a victim to enable macro settings. This functionality is expressed as a set of codes and ciphers presented in a .doc file. If a user accidentally grants the permission, he or she activates CryptoWall. Then, the virus starts its data hunt. Within a couple of minutes, the mentioned DECRYPT_INSTRUCTIONS.txt and DECRYPT_INSTRUCTIONS.html files will appear on the device. In addition, the late versions of CryptoLocker might have been relying on trojans and exploit kits to multiple the range of the attack. In that case, you will need to arm up with proper cyber security programs.


If you remove DECRYPT_INSTRUCTIONS.html file, the malware will keep rampaging on your computer. Banish the malware and all its components with the reliable anti-spyware application, e.g. Reimage or Plumbytes Anti-MalwareNorton Internet Security. Do not forget to update the program for it to fully complete DECRYPT_INSTRUCTIONS.html removal and the elimination of the file-encrypting threat. After eliminating the infection, you can consider alternative methods to recover your data.

verdict - status of the file:
dangerous file
Advice: If your computer seems sluggish, or you are suffering from unwanted advertisements and redirects to unknown websites, we highly recommend you to scan it with reputable anti-spyware program. Do some FREE scan tests and check the system for unwanted applications that might be responsible for these problems.
We might be affiliated with any product we recommend on the site. Full disclosure in our Agreement of Use. By Downloading any provided Anti-spyware software you agree to our privacy policy and agreement of use.
do it now!
Problem diagnosis program Happiness
Problem diagnosis program Happiness
Compatible with Microsoft Windows Compatible with OS X
What to do if failed?
If you failed to remove infection using Reimage, submit a question to our support team and provide as much details as possible.
Reimage is a recommended tool to scan your system for possible threats and crappy software. The trial version of the product will find harmful applications in your system.
More information about this program can be found in Reimage review.
Press mentions on Reimage
Alternate Software
Plumbytes Anti-Malware
Hitman Pro

About the author

Ugnius Kiguolis
Ugnius Kiguolis - The mastermind

If this free removal guide helped you and you are satisfied with our service, please consider making a donation to keep this service alive. Even a smallest amount will be appreciated.

Contact Ugnius Kiguolis
About the company Esolutions

Removal guides in other languages