CryptoWall is still being distributed and can be found in the wild. One of the nastiest viruses out there as you can see from the variety of responses here. And yet there is no method for the full decryption of data locked by this ransomware. Removing it efficiently will rely on a good anti-malware tool. All security programs will have this in their definitions (unless they are not targetting viruses but a more specific area in IT security). Here is an example of how to remove the ransomware and several ways you could try to recover some files encrypted by CryptoWall Your friend probably already removed the ransomware but still might not have recovered the lost data. Reading about new ways to try and restore files is always a plus. Data recovery programs are reported as of late to work in partial recovery of the data locked by ransomware. If files were deleted before the encryption process and the disk drive was not formatted since there is a big chance at least a few files to be recovered. Try a few methods for recovery which you haven tried before and pray. Also try searching for other ways to unlock your friend files. Best of luck!