I've got a weird situation here and wanted to see if anyone else has run across this. Windows Security Essentials found Cryptowall on a system here and was able to remove the trojan that causes drops the payload. I've only found the infamous HELP_DECRYPT files in an Adobe PDF folder under program files, but everything seems to be opening properly still. I can open PDFs, Docs, jpgs, etc. with no problem. Does the infection creep in slowly, or can I assume the infection has been taken care of? I took it offline to be on the safe side and am currently running MSS and MBAM as we speak. Thanks for any advice!
In your case, I would backup all my files if it's not already done (It's the only reliable solution against ransom-ware).
According to http://www.sentinelone.com/blog/anatomy-of-cryptowall-3-0-a-look-inside-ransomwares-tactics/ you can look at
HKCU/Software/(CUUID)/(sorted 2nd half of CUUID)/(FullFilePath) = (Volume Serial Number)
And you will see the list of encrypted files if any. Continue scanning your workstation with antivirus solution. You can also launch procexp from Sys Internals and check if you see any wired process running. Click on Options->Verify Image Signatures to be sure that a process is not masquerading as a legit one. Malware are used to be named as Microsoft binaries (svchost or else).
Hope this helps.