Hi First, I’d like to thank Talos for the great Cryptowall description. Last week one computer in my environment was targeted with Cryptowall 3.0. It was an old box, almost unused, but during attack it was mapped to two important network resources. One of them was located on Windows 2003 Server (yes, it’s still running here!) and the second was on Samba server based on Linux. Some of the files on Samba share was damaged according to their file extension, but NONE of the Win’2003SRV files was hurt. I found four infamous “HELP_DECRYPT” files written down to root directory on Win’2003 share, but no file was damaged and “HELP_DECRYPT” files didn’t occur on subsequent directories. Can you explain, is there any fundamental reason, why Cryptowall was unable to harm files on Win’2003 share? If yes, is it possible to build other resources in such way to prevent Cryptowall doing it’s bloody work. The user connected to Win’2003 had read/write access to all files on this share, but without full control.