Published Oct 15, 2014 | Updated Sep 15, 2017


Severe |Detected with Windows Defender Antivirus

Aliases: No associated aliases


Windows Defender detects and removes this threat.

This family encrypts your files and shows you a webpage that asks you to pay a fee to unlock them.ransomware

They can be installed on your PC by other malware, such as , or as a spam email attachment.TrojanDownloader:O97M/Donoff

Our  page has more information on this type of threat.ransomware FAQ

Read our latest comprehensive ransomware report:

Ransomware 1H 2017 review: Global outbreaks reinforce the value of security hygiene

Microsoft doesn’t recommend you pay the fine. There is no guarantee that paying the ransom will give you access to your files.

If you've already paid, see for help on what to do now.our ransomware page

Use the following free  software to detect and remove this threat:Microsoft

You should also run a full scan. A full scan might find other, hidden malware.

You might be able to recover encrypted files by using the tool discussed in the MMPC blog post .FireEye and Fox_IT tool can help recover Crilock-encrypted files

To restore your PC, you might need to . See our  for more and run Windows Defender Offlineadvanced troubleshooting page


You can also visit our  or search the for more help.advanced troubleshooting pageMicrosoft virus and malware community

If you’re using , see our .Windows XPWindows XP end of support page

Run antivirus or antimalware software
Advanced troubleshooting
Get more help