Located "patient zero". But i need to find out how the infection got in (someone needs answers). Checked IE logs, emails, nothing out of the ordinary.
Cannot find any processes out of the ordinary. User was no administrator (removed local privileges after the first infection). And no, i'm not allowed to enforce whitelisting as of yet.
The help files are called HELP_YOUR_FILES, and filenames are scrambled too.