.Crysis files encrypted on domain controller

Hi there,

A customer called to say that a domain controller has been infected with a cryptolocker type variant. File extensions have been modified and extensions have .crysis at the end of the files.

Any ideas on what to get these files cleaned/decrypted? I have recommended the symdiag tool ,power eraser and nothing gets detected.

Thanks