Severity scale:  

HELP_DECRYPT virus. How to remove? (Uninstall guide)

removal by Gabriel E. Hall - -   Also known as CryptoWall | Type: Ransomware

HELP_DECRYPT is a malicious file that is closely related to CryptoWall ransomware. Therefore, if you have just noticed it or any of these files (HELP_DECRYPT.png, HELP_DECRYPT.txt, HELP_DECRYPT.html) in one of your folders, then you may be caught in a serious trouble. The appearance of this file on your computer notifies that it is infected by a ransomware that seeks to encrypt personal files like, for instance, photos, documents, videos, and so on. More information about this file is given below:

What is HELP_DECRYPT file?

As we have already noted, HELP_DECRYPT file is a ransomware-related component used for executing CryptoWall virus. This threat attacks computers immediately after the user clicks on an infected link or Zip attachment of spam email. Besides, recent research has revealed that this ransomware is actively spreading using exploit kits that find the smallest gap in computer’s security system. In fact, the emergence of the malicious HELP_DECRYPT file is a clear sign that ransomware is initiating its dirty deeds on your PC’s system and you have no chance of stopping it. Once installed, CryptoWall ransomware scans the system for personal files that carry .doc, .docx, .xls, .ppt, .psd, .pdf, .eps, .ai, .cdr, .jpg, etc. extensions and encrypts each of them with the help of RSA encryption algorythm. Right after that, it fills each of folders with the following files: help_decrypt.txt, help_decrypt.html, help_decrypt.png, and help_decrypt.url.

Besides, once CryptoWall virus finished encryption, the user is presented with a HELP DECRYPT virus window explaining what was done with the data stored on a computer and what the user has to do to decrypt affected files. To be more precise, the user is required to use Tor browser and pay $500 ransom in Bitcoins. No matter how important the encrypted files are, you should not even consider paying the ransom because you will only support online frauds and lose a huge amount of money without a guarantee that HELP_DECRYPT file will be gone, and your personal data will be decrypted. Therefore, we highly recommend you to remove CryptoWall virus with the help of Reimage or another reputable anti-spyware and use a reliable file recovery tool for getting your files back.

the example of HELP_DECRYPT virus alert

How does HELP_DECRYPT malware infect a computer?

This malicious file is triggered by CryptoWall ransomware. Security experts warn people about this ransomware infection on a daily basis, so you may already know that this adware is using exploit kits and quite easily finds loopholes in computer’s security system. Therefore, please never open suspicious emails because they may be filled with infected attachments. Besides, avoid visiting illegal websites because they may contain links or fake update alerts (Java, Flash Player, Media Player, Adobe Reader, etc.) filled with CryptoWall executable. Right after the executable file is launched, HELP DECRYPT virus starts running on Windows startup, CryptoWall starts encrypting files, and sooner or later the user may receive an alert informing about data encryption and the performances that people must and cannot take to get them back. If you have already got infected with CryptoWall ransomware, you should see such a notification on your screen:

What happened to your files ?
All of your files were protected by a strong encryption with RSA-2048 using CryptoWall 3.0. More information about the encryption keys using RSA-2048 can be found here:

What does this mean ?
This means that the structure and data within your files have been irrevocably changed, you will not be able to work with them, read them or see them, it is the same thing as losing them forever, but with our help, you can restore them.

How did this happen ?
Especially for you, on our server was generated the secret key pair RSA-2048 – public and private. All your files were encrypted with the public key, which has been transferred to your computer via the Internet. Decrypting of your files is only possible with the help of the private key and decrypt program, which is on our secret server.

What do I do ?
Alas, if you do not take the necessary measures for the specified time then the conditions for obtaining the private key will be changed. If you really value your data, then we suggest you do not waste valuable time searching for other solutions because they do not exist.
For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below:

How to remove HELP_DECRYPT virus from my PC?

To stop HELP_DECRYPT file from running and remove it from the system, you will have to remove CryptoWall virus once and for all. Unfortunately, this cannot be done manually because ransomware and similar programs hide under various files and can hide deep in the system as long as they need. The best solution for this file + ransomware removal would be to select a full system scan with the reliable anti-spyware program. These tools have already been tested when trying to detect the malware of HELP_DECRYPT file: Reimage, Malwarebytes, Plumbytes Anti-MalwareNorton Internet Security.

Besides, right after that, don’t forget to look for extra copies of your files. They can be saved on external hard drives, CDs, DVDs, or simply rely on Google Drive, Dropbox, Flickr and other solutions. Think about them when saving your next file that you consider important. This is especially recommended for photos, music and video files, art and similar documents.

We might be affiliated with any product we recommend on the site. Full disclosure in our Agreement of Use. By Downloading any provided Anti-spyware software you agree to our privacy policy and agreement of use.
do it now!
Reimage (remover) Happiness
Reimage (remover) Happiness
Compatible with Microsoft Windows Supported versions Compatible with OS X Supported versions
What to do if failed?
If you failed to remove virus damage using Reimage, submit a question to our support team and provide as much details as possible.
Reimage is recommended to remove virus damage. Free scanner allows you to check whether your PC is infected or not. If you need to remove malware, you have to purchase the licensed version of Reimage malware removal tool.

Note: Manual assistance required means that one or all of removers were unable to remove parasite without some manual intervention, please read manual removal instructions below.

More information about this program can be found in Reimage review.

If you decided to select another anti-spyware, uninstall Reimage from your computer.
Press mentions on Reimage
Alternate Software
Alternate Software

HELP_DECRYPT virus manual removal:

Kill processes:



To remove HELP_DECRYPT virus, follow these steps:

Remove HELP_DECRYPT using Safe Mode with Networking

  • Step 1: Reboot your computer to Safe Mode with Networking

    Windows 7 / Vista / XP
    1. Click Start Shutdown Restart OK.
    2. When your computer becomes active, start pressing F8 multiple times until you see the Advanced Boot Options window.
    3. Select Safe Mode with Networking from the list Select 'Safe Mode with Networking'

    Windows 10 / Windows 8
    1. Press the Power button at the Windows login screen. Now press and hold Shift, which is on your keyboard, and click Restart..
    2. Now select Troubleshoot Advanced options Startup Settings and finally press Restart.
    3. Once your computer becomes active, select Enable Safe Mode with Networking in Startup Settings window. Select 'Enable Safe Mode with Networking'
  • Step 2: Remove HELP_DECRYPT

    Log in to your infected account and start the browser. Download Reimage or other legitimate anti-spyware program. Update it before a full system scan and remove malicious files that belong to your ransomware and complete HELP_DECRYPT removal.

If your ransomware is blocking Safe Mode with Networking, try further method.

Remove HELP_DECRYPT using System Restore

  • Step 1: Reboot your computer to Safe Mode with Command Prompt

    Windows 7 / Vista / XP
    1. Click Start Shutdown Restart OK.
    2. When your computer becomes active, start pressing F8 multiple times until you see the Advanced Boot Options window.
    3. Select Command Prompt from the list Select 'Safe Mode with Command Prompt'

    Windows 10 / Windows 8
    1. Press the Power button at the Windows login screen. Now press and hold Shift, which is on your keyboard, and click Restart..
    2. Now select Troubleshoot Advanced options Startup Settings and finally press Restart.
    3. Once your computer becomes active, select Enable Safe Mode with Command Prompt in Startup Settings window. Select 'Enable Safe Mode with Command Prompt'
  • Step 2: Restore your system files and settings
    1. Once the Command Prompt window shows up, enter cd restore and click Enter. Enter 'cd restore' without quotes and press 'Enter'
    2. Now type rstrui.exe and press Enter again.. Enter 'rstrui.exe' without quotes and press 'Enter'
    3. When a new window shows up, click Next and select your restore point that is prior the infiltration of HELP_DECRYPT. After doing that, click Next. When 'System Restore' window shows up, select 'Next' Select your restore point and click 'Next'
    4. Now click Yes to start system restore. Click 'Yes' and start system restore
    Once you restore your system to a previous date, download and scan your computer with Reimage and make sure that HELP_DECRYPT removal is performed successfully.

About the author

Gabriel E. Hall
Gabriel E. Hall - Passionate web researcher

If this free removal guide helped you and you are satisfied with our service, please consider making a donation to keep this service alive. Even a smallest amount will be appreciated.

Contact Gabriel E. Hall
About the company Esolutions

Removal guides in other languages