Send us feedback
Aliases: No associated aliases
Windows Defender detects and removes this threat.
This ransomware encrypts the files on your PC and shows you a webpage with instructions on how to decrypt them.
This threat might have been downloaded onto your PC by other malware.
You can read more on our ransomware page.
If you've already paid, see our ransomware page for help on what to do now.
Run antivirus or antimalware software
Use the following free Microsoft software to detect and remove this threat:
- Windows Defender Antivirus for Windows 10 and Windows 8.1, or Microsoft Security Essentials for Windows 7 and Windows Vista
- Microsoft Safety Scanner
You should also run a full scan. A full scan might find hidden malware.
Get more help
If you’re using Windows XP, see our Windows XP end of support page.
This threat can create files in your PC, for example:
Encrypts your files
This threat encrypts files on your PC that have the following extensions:
We have observed some variants do not encrypt the Bitcon wallet file wallet.dat.
Some variants of this threat delete shadow files to prevent users from restoring files from a local back up.
This threat uses TOR to communicate with its backend server.
- You can't open your files
- You see a message like the following: