Tor Stack Exchange is a question and answer site for researchers, developers, and users of Tor. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I went to a dangerous website using an unpatched browser and/or risky plugins like Java, Flash, and Adobe Reader, and now something has taken over my computer and encrypted my files. It left me a note saying that I need to get Bitcoins and then download Tor Browser to pay the ransom, or I'll never see my files again!

What's going on? Why is Tor involved?

share|improve this question

What's going on?

You got a malware that encrypted all your files. To get them back, you have to pay. This type of malware is called Ransomware (Wikipedia).

What do you mean by encrypted all my files?!

When you caught the ransomware, it took your files one by one and encrypted it with a key. When all your files were encrypted, it probably created a small text file on your desktop with a name along the line of README_TO_GET_YOUR_FILES_BACK.txt.

But if it encrypted all my files, the key must be somewhere!

It totally depends of the ransomware, but probably not. Chances are, it used Assymetric cryptography to encrypt your files. Basically, you have one key to encrypt, and another one to decrypt. Even if you found the key used to encrypt your files, it wouldn't help you to decrypt them. The attackers have the key you want and did not put it in the ransomware; and they want you to pay to get it.

You can still try to search on Google, copy-pasting their message to see if you can find the name of your malware (TeslaCrypt, CryptoLocker, CryptoWall, etc.). You may get more information, and perhaps a solution to recover your file if it was a weak ransomware. However, do NOT download random Ransomware Removal Tools1 and remember that it was probably by downloading some fishy files that you caught the ransomware in the first place.

1 You can trust some websites! For example, Kaspersky provides a free tool to get rid of CoinVault and Bitcryptor.

Why is Tor involved? And Bitcoins?

You can recognize a Tor link with the .onion at the end.

They use Tor because it makes it harder for law enforcement to find them. It has nothing to do with the Tor project per se. The same goes for Bitcoins: they are harder to track than a bank transfer; like in the movies when the kidnappers ask for cash-only-20-unmarked-bills.

Tor and Bitcoins offer you to improve your privacy/anonymity. Everybody likes more privacy, unfortunately including bad people.

Should I pay? Will they give me my files back?

I would like to say that you should not, but it isn't realistic. This is a decision that you have to make. I would still suggest that you pay only if you have very valuable data2 that you want to get back. You game saves or grocery list are probably not worth to be saved.

Some people says that you are likely to get your files back. Ransomwares work because people pay; and people pay because they think they will get their files back. The fact is: you don't know.

It seems that they also have a great customer service. Link-1 - Link-2

2 What you should consider as valuable data is up to you.

What should I do next ?

Whether or not you got your files back, you should do a clean install: reformat your whole drive and reinstall the OS. Other malwares might have been installed along with the ransomware.

Keep your system and softwares up-to-date, don't visit suspicious websites and make regular backups of your files! (At least the important ones.)

I want to know more about the relation between Tor and ransomwares!

Take a look at Roger Dingledine's answer.

share|improve this answer
@RogerDingledine It's also worth noting that there is such a thing as "psuedo ransomware." This is software that claims it has encrypted your data, when really it hasn't. Sometimes such malware locks your system down. But in those cases, it hasn't really encrypted your data. It's therefore possible that OP has only been a victim of psuedo-ransomware. If that happens to be the case, it's easy to retrieve the data without paying. He could then just boot Ubuntu from a Live CD and copy all the files to an external storage device. So first step: Check it your files are actually encrypted. – Fiksdal Apr 17 at 14:48
Fiksdal: Interesting point. Are there any of these imitation ransomwares that point the victim to onion addresses? Can you/anybody here point to any? Thanks! – Roger Dingledine Apr 17 at 19:18
@Fiksdal: indeed, some ransomwares don't encrypt your data but find a way to lock you out of your computer (e.g. WinLock?). A ransomware is a malware that tries to blackmail the victim; it includes the ones that encrypt the victims' files and ask them to pay, but it's not limited to that type. That's the reason I didn't try to define what a ransomware is. IMO, it might lose the reader. – Yuriko Apr 18 at 5:47
@RogerDingledine No, didn't find any. So I guess the files mentioned in OP were most likely actually encrypted. My point was though, that the people who make this malware are not exactly trustworthy. Therefore, rather than just taking them on their word, we could instead check if the data has actually been encrypted and overwritten completely from the sectors of the drive. – Fiksdal Apr 18 at 9:31
I can't answer you, I don't know if there was a study on that aspect. However, I am pretty sure that the files are not overwritten, simply because the cipher files and the plain files are not the same size (padding). The steps are 1. create the cipher file 2. delete the plain one. I don't know if ransomwares delete the file in a secure fashion. In the case the files are not securely deleted, retrieving them using tools like photorec is still very painful. It might save you if you have a few very important files, but it's not what I would call a solution. – Yuriko Apr 18 at 11:00

I'm sorry to hear that! It sounds like you have been infected with ransomware named "Cryptowall". This is a type of malware that encrypts your files and deletes the originals, and then blackmails you into paying the malware authors for the decryption key. The authors are in Russia or somewhere similar, so they want you to pay them with Bitcoin.

Cryptowall has nothing to do with Tor. We (Tor) are bystanders too, dragged into this mess by the jerks in Russia who infected your computer. We're as upset as you are. And we're especially sad that this might be your first introduction to Tor, which is used by millions of people around the world, including ordinary citizens who want protection from identity theft and prying corporations, corporations who want to look at a competitor's website in private, bloggers and activists whose Internet connections are censored or surveilled, and even governments and law enforcement.

Ransomware is a huge and growing concern on the Internet. Apparently the Cryptowall people have collected more than $18M USD as of mid 2015 (!), so you are far from alone. Sadly, even organizations like hospitals have been affected.

The best answer, but alas it's probably too late for you now, is to avoid running insecure software. Be sure to stay up-to-date on all your software updates and patches, and also avoid running things like Flash that always seem to have security problems. The second best answer, and maybe this one isn't too late for you, is to do frequent backups. Maybe you can just go to one of your backups and restore your files?

Ok, so why is Tor Browser involved here at all? The simple answer as far as we can tell is that the jerks who wrote Cryptowall decided Tor is cool, so they wanted to include it somehow. They set up a ransom website to receive your bitcoins, and they gave it a Tor onion address rather than a more normal web address. Tor onion services can provide stronger security to users who want to be sure they're reaching the right service (that's why Facebook runs one), and they can also provide stronger security to the service side too, for example by making it hard to learn where the website is located. But in this case, the Cryptowall people aren't relying just on the onion service security. Since they're in Russia or the like, the authorities won't do anything even if they do learn their names or location. :(

There are hundreds of variants of ransomware in the world, and most just host their websites in Malaysia or some other country that doesn't care to answer legal demands. That is, Cryptowall doesn't rely on Tor to accomplish its goals. You probably think (quite reasonably) that they are terrible people for ruining your day. We think that they are terrible people for dragging Tor into this, and for giving privacy a bad reputation.

In closing, I'm afraid we don't have any good answers to questions like "should I pay them" or "if I pay them, how do I know I'll get my files". It's a crummy situation all around -- especially because your US dollars and Euros go a long way in Russia, which keeps the cybercrime engine going. This is another illustration of the "bad people on the Internet are doing great, and good people don't have enough tools to help them" situation that we'd like to fix.

[Can somebody point to a great tutorial on how to clean up after Cryptowall, how to lock down your system afterwards, etc? All the ones I found were thinly veiled advertisements by antivirus companies, and their motivations mean they always recommend their own product. We should edit the end of this answer to point to those great tutorials.]

share|improve this answer
How do you know this is CryptoWall? I can't find any information in OP's post leading to that one especially. About your last paragraph on "how to clean up after CryptoWall?", unfortunately, you need to reformat the whole drive. You don't know if anything else has been installed. The computer might be infected. – Yuriko Mar 23 at 8:30
This answer has a lot of issues. (1) What's with all the references to "we"? Are you part of the Tor project?, (2) Repeated sections e.g. the $18m figure, (3) Large irrelevant sections. The question is about why Tor is involved, not about solutions to deal with the ransomware, (4) Assumption about CryptoWall as per comment above, (5) Assertion that Russian police/judiciary would do nothing to these people if caught (unlikely), with no sources to back your claim, (6) Assumption that they are using Tor just because it is "cool" and that they don't care about being identified (again, unlikely). – JBentley Mar 23 at 8:40
I just realized this is an attempt for a canonical answer. I totally agree with @JBentley: there is too much "Don't blame Tor!". However, as this is an attempt to make a canonical answer, I think there are very few advices that would be really useful for a victim stumbling on this thread (what happened to my files? what should I do? will I get get my files back?). These are totally opinion-based questions, but they are the only ones that matter for the desperate reader. – Yuriko Mar 23 at 9:08
I noticed that CryptoWall is used as a tag. However, I don't see why we should restrain the thread to this particular ransomware. – Yuriko Mar 23 at 10:07
@JBentley: A user commented on your post: »Footnote: I'm not allowed to comment yet, so I'll respond here to JBentley. He asks, "Are you [ie is Roger Dingledine] part of the Tor project?". Yes, rather a large part. You can look him up, here – Jens Kubieziel Mar 23 at 20:31

Does it tell you to got to a site ending with .onion or .exit? Probably they will give you a bitcoin address or let you download a key when you go to their site. They use a tor hidden service so that they will not so easily be traced.

share|improve this answer

The answers you have already been given are spot on but I thought you, or somebody else seeing this question, might be interested in a Beta that Malwarebytes are currently running that stops the very thing that unfortunately happened to you. I'm not connected with Malwarebytes in any way, shape or form but I have been using the Beta now for a few weeks and it has saved me a few times already! Malwarebytes Ransomware Beta

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.