What type of crypto ransomware are you dealing with? Are there any file extensions appended to your files...such as .ecc, .CTBL, .CTB2, .XTBL
or 6-7 length extension consisting of random characters?
Did you find any ransom note? These infections are created to alert victims that their data has been encrypted and demand a ransom payment. Check your documents folder for an image the malware typically uses for the background note. Check the C:\ProgramData (or C:\Documents and Settings\All Users\Application Data) for a random named .html, .txt, .png, .bmp, .url file.
These are some examples.
DECRYPT_INSTRUCTION.TXT, DECRYPT_INSTRUCTION.HTML, DECRYPT_INSTRUCTION.URL
HELP_DECRYPT.TXT, HELP_DECRYPT.HTML, HELP_DECRYPT.URL, HELP_DECRYPT.PNG
Does it look like one of these or something else...?
* PClock (WinCL variant)
* PClock (newer Windsk variant)
If the ransomware does not look like any of those in the above links...reading through the following information may assist with identifying the crypto malware infection you are dealing with.
Once you have identified which particular ransomware you are dealing with, we can direct you to the appropriate discussion topic for further assistance.