So I had my first encounter with CryptoWall last Friday. Unfortunately the user that had been infected at 10:00 am, did not inform my supervisor or myself until around 3:30 in the afternoon. After stopping me in the hallway, they proceeded to tell me that some files where displaying errors when they opened them, and that they had seen a popup earlier in the morning but didn't want to say anything. ...*Sigh, why would they want to save me time and effort, or give me something to go on other than it was an error.*
Anyways, I walked over to the users station to took a look at the file she was complaining about. I immediately saw the Help_decrypt files sitting there, I unplugged the network cable and went to go find my boss. After a brief scramble we contained the situation and restored from a snap shot taken early that morning. All...