I've got a weird situation here and wanted to see if anyone else has run across this. Windows Security Essentials found Cryptowall on a system here and was able to remove the trojan that causes drops the payload. I've only found the infamous HELP_DECRYPT files in an Adobe PDF folder under program files, but everything seems to be opening properly still. I can open PDFs, Docs, jpgs, etc. with no problem. Does the infection creep in slowly, or can I assume the infection has been taken care of? I took it offline to be on the safe side and am currently running MSS and MBAM as we speak. Thanks for any advice!

  • I just had the same symptoms. I downloaded ammyy admin (the russian remote software tool), and it had cryptowall attached to it. But my luck was they didn't encrypt anything. I believe they require some version of dot.net I hadn't installed, because the PC was new and clean.
    – Daniel
    Dec 30, 2015 at 13:38

1 Answer 1


In your case, I would backup all my files if it's not already done (It's the only reliable solution against ransom-ware).

According to http://www.sentinelone.com/blog/anatomy-of-cryptowall-3-0-a-look-inside-ransomwares-tactics/ you can look at

HKCU/Software/(CUUID)/(sorted 2nd half of CUUID)/(FullFilePath) = (Volume Serial Number)

And you will see the list of encrypted files if any. Continue scanning your workstation with antivirus solution. You can also launch procexp from Sys Internals and check if you see any wired process running. Click on Options->Verify Image Signatures to be sure that a process is not masquerading as a legit one. Malware are used to be named as Microsoft binaries (svchost or else).

Hope this helps.

  • Thanks so much for the information! The help_decrypt files are dated at the first of april. Is this when the infection began? Jun 18, 2015 at 17:58
  • It could indicate that the file (help_decrypt) was dropped at this time (but be aware that file time stamps can be modified with SetFileTime). I don't know if CryptoWall is used to modify time stamps or not. Moreover, the ransomware could be dropped by another trojan which has infected your machine earlier. As CryptoWall is used to spread by email phishing, if you want to investigate, you can check if you opened a wired email near this date (take care of not infecting yourself again) by looking at your mailbox. It will give you a clue if it's the case.
    – r00t
    Jun 19, 2015 at 9:00
  • With regards to taking backups, I believe it would be wise to shut down the machine, and make a backup via a different method, such as a live Linux distro, or placing the drive in a non-Windows PC.
    – Phizes
    Jul 19, 2015 at 11:19

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .