CryptoWall .aaa Extension

Posted by Lisa Blanc on August 7, 2015

What is CryptoWall .aaa Extension?

Have you noticed an odd extension added to files? If the extension in question is .aaa, then you have been infected with a new variant of CryptoWall ransomware. Lately, there has been an onslaught of infections that encrypt user’s files and then demand a ransom. CryptoWall is just one of the many malicious programs from the group. We have seen such malicious infections as CryptoDefense Virus, CryptoLocker Virus, TorLocker Virus, CTB-Locker, and so on. All of them have specific features, and they affect your files in the individual way. The CryptoWall .aaa Extension happens to be a constituent part of the CryptoWall infection. test

Where does CryptoWall come from?

We have first heard of CryptoWall at the beginning of 2015. It was tagged as a new campaign of Win32/Crowti, which is yet another ransomware infection. According to computer security researchers, ransomware programs are often downloaded onto the target computer by other malware, for example, TrojanDownloader:Win32/Upatre or TrojanDownloader:Win32/Onkods. We would like to emphasize that this is an important piece of evidence which supports the idea that there are multiple infections on the computer affected by CryptoWall. To put it simply, the ransomware program is not the only security threat on-board. We would expect nothing less of this program, considering that almost all ransomware applications are distributed by other malware, and they serve as a payload through various exploits.

What does CryptoWall .aaa Extension have to do with it?

The CryptoWall .aaa Extension is added to all the files that have been infected by the CryptoWall encryption. The .aaa extension is appended after the original extension. Aside from encrypting the files and changing file extensions, the ransomware also drops ransom notes that contain instructions how to transfer the payment to the people behind this program. The instruction files are titled restore_files_hprjq.html and restore_files_hprjq.txt. The information in the files says that “the structure and data within your files have been irrevocably changed; you will not be able to work with them, read them or see them.” Hence, the CryptoWall .aaa Extension added to your files, which indicates that your files have been affected by this intruder.

What are the prevention measures?

Prevention measures that should help users avoid this infection, and consequently seeing CryptoWall .aaa Extension appended to their files, are always given in every security article that deals with the crypto ransomware. The most important thing is to avoid visiting suspicious websites that might be associated with malware distribution. What’s more, you should avoid opening email messages from unfamiliar senders, especially if they have attachments.

Unfortunately, there is a good chance that you will not be able to do much about your files. There is a possibility that you could decrypt them with a professional decryption tool, but more of than not users simply need to start anew. The best way to restore your files is to import them back from an external hard disk or a virtual cloud drive. Therefore, you should not think twice about backing up your files because it is better to be safe than sorry.

Should you have any further questions on the CryptoWall infection, or how to protect your system from harm, you can always leave us a comment. A reliable computer security tool might also help you do the job.