Ransom:Win32/Loktrom.B
Windows Defender detects and removes this threat.
This threat locks your PC and displays a full-screen message, commonly called a "lock screen".
It pretends to be from the FBI or a national police force and tries to scare you into paying a fine to unlock your PC.
See the Technical information tab for examples of the lock screen.
Typically, this threat gets on your PC when you visit a hacked webpage.
You can read more about this type on malware on our ransomware page.
Ransom:Win32/Loktrom.A
This threat is a trojan that prevents you from accessing your desktop. It displays a message screen stating that you need to send payment to a certain prepaid mobile account to unlock the desktop.
Ransom:Win32/Genasom.BP
Microsoft Defender Antivirus detects and removes this threat.
This threat stops you from loading Windows and displays a full-screen message, commonly called a "lock screen". If this threat asks you to pay a fee or fine, do not pay it. The message is a fraud.
It tries to scare you into paying a fine or texting a premium-charge phone number to unlock your PC.
You can read more on our ransomware page.
The trend towards increasingly sophisticated malware behavior, highlighted by the use of exploits and other attack vectors, makes older platforms so much more susceptible to ransomware attacks. From June to November 2017, Windows 7 devices were 3.4 times more likely to encounter ransomware compared to Windows 10 devices.
Read our latest report: A worthy upgrade: Next-gen security on Windows 10 proves resilient against ransomware outbreaks in 2017.
Ransom:MSIL/JigsawLocker.A
Microsoft Defender Antivirus detects and removes this threat.
This ransomware can stop you from using your PC or accessing your data. It might ask you to pay money to a malicious hacker.
The trend towards increasingly sophisticated malware behavior, highlighted by the use of exploits and other attack vectors, makes older platforms so much more susceptible to ransomware attacks. From June to November 2017, Windows 7 devices were 3.4 times more likely to encounter ransomware compared to Windows 10 devices.
Read our latest report: A worthy upgrade: Next-gen security on Windows 10 proves resilient against ransomware outbreaks in 2017.
Ransom:MSIL/Sylock.A
Windows Defender AV detects and removes this threat.
This ransomware can stop you from using your PC or accessing your data. It might ask you to pay money to a malicious hacker.
Our ransomware FAQ page has more information on this type of threat.
The trend towards increasingly sophisticated malware behavior, highlighted by the use of exploits and other attack vectors, makes older platforms so much more susceptible to ransomware attacks. From June to November 2017, Windows 7 devices were 3.4 times more likely to encounter ransomware compared to Windows 10 devices.
Read our latest report: A worthy upgrade: Next-gen security on Windows 10 proves resilient against ransomware outbreaks in 2017.
Ransom:Win64/Reveton.E
Microsoft Defender Antivirus detects and removes this threat.
This threat is a member of the Reveton family of ransomware that can prevent access to your computer and demand that you pay a fine. This variant can disable the Windows firewall and modify the registry.
Typically, these threats get onto your PC during a drive-by download attack. They can also be installed when you visit a compromised or hacked webpage.
Our ransomware FAQ page has more information on this type of threat.
The trend towards increasingly sophisticated malware behavior, highlighted by the use of exploits and other attack vectors, makes older platforms so much more susceptible to ransomware attacks. From June to November 2017, Windows 7 devices were 3.4 times more likely to encounter ransomware compared to Windows 10 devices.
Read our latest report: A worthy upgrade: Next-gen security on Windows 10 proves resilient against ransomware outbreaks in 2017.
Ransom:Win32/Reveton.T!lnk
Microsoft Defender Antivirus detects and removes this threat.
Ransom:Win32/Reveton.T!lnk is a shortcut file used by members of the Ransom:Win32/Reveton family of ransomware to ensure they load each time you start your PC.
This family of ransomware targets users from certain countries. They lock your PC and display a localized webpage that covers your desktop and demands the payment of a fine for the supposed possession of illicit material.
Our ransomware FAQ page has more information on this type of threat.
The trend towards increasingly sophisticated malware behavior, highlighted by the use of exploits and other attack vectors, makes older platforms so much more susceptible to ransomware attacks. From June to November 2017, Windows 7 devices were 3.4 times more likely to encounter ransomware compared to Windows 10 devices.
Read our latest report: A worthy upgrade: Next-gen security on Windows 10 proves resilient against ransomware outbreaks in 2017.
Ransom:Win32/Reveton.F!lnk
Microsoft Defender Antivirus detects and removes this threat.
Ransom:Win32/Reveton.F!lnk is a detection for shortcut files (LNK) created by a variant of the Win32/Reveton family. If your PC is detected with this threat, then it is likely that you have also been infected by Ransom:Win32/Reveton.F.
Our ransomware FAQ page has more information on this type of threat.
The trend towards increasingly sophisticated malware behavior, highlighted by the use of exploits and other attack vectors, makes older platforms so much more susceptible to ransomware attacks. From June to November 2017, Windows 7 devices were 3.4 times more likely to encounter ransomware compared to Windows 10 devices.
Read our latest report: A worthy upgrade: Next-gen security on Windows 10 proves resilient against ransomware outbreaks in 2017.
Ransom:MSIL/SamSam.D!dr
Microsoft Defender Antivirus detects and removes this threat.
This ransomware can stop you from using your PC or accessing your data. It might ask you to pay money to a malicious hacker to restore your files.
This threat is the dropper component of Ransom:MSIL/SamSam.
Our ransomware FAQ page has more information on this type of threat.
Ransom:MSIL/Paggalangrypt.A!rsm
Microsoft Defender Antivirus detects and removes this threat.
This ransomware renders files inaccessible by encrypting them. It renames encrypted files to add the extension name .enc.
After encrypting files, this ransomware sets the desktop wallpaper. The wallpaper serves as a ransom note, providing instructions on how one can pay to restore access to encrypted files or avoid subsequent attacks.
Find out ways that malware can get on your PC.
Read our latest report about ransomware protection: A worthy upgrade: Next-gen security on Windows 10 proves resilient against ransomware outbreaks in 2017.
Ransom:Win32/HydraCrypt.A
Microsoft Defender Antivirus detects and removes this threat. This ransomware can stop you from using your PC or accessing your data. It might ask you to pay money to malicious hacker.
We have seen this threat distributed by exploit kits (Neutrino, Axpergle, and Exploit:Win32/CVE-2016-0034), and through URLs embedded in spam emails that points to malicious macro downloaders.
Our ransomware FAQ page has more information on this type of threat.
The trend towards increasingly sophisticated malware behavior, highlighted by the use of exploits and other attack vectors, makes older platforms so much more susceptible to ransomware attacks. From June to November 2017, Windows 7 devices were 3.4 times more likely to encounter ransomware compared to Windows 10 devices.
Read our latest report: A worthy upgrade: Next-gen security on Windows 10 proves resilient against ransomware outbreaks in 2017.
Ransom:MSIL/Samas.A
Windows Defender Antivirus detects and removes this threat.
This ransomware family encrypts the files on your PC. It shows you a message that says you must pay for decryption software to get access to your files again.
You can read more about this type of threat on our ransomware page.
Ransom:Win32/LockScreen.CI
Ransom:JS/Brolo.A
Microsoft security software detects and removes this family of threats.
This ransomware family can lock your web browser by showing you a message that asks you to pay a fine. The message can pretend to be from a law enforcement agency and tells you to pay money to unlock your browser.
They can also stop you from closing your web browser, using the address bar, or pressing any shortcut keys.
You can be infected with this threat when you visit or are redirected to a malicious website.
See the Ransom:JS/Brolo family description for more information.
Ransom:Win32/Cribit.A
Windows Defender detects and removes this threat.
This threat stops you from opening your files and displays a message, commonly called a "lock screen".
It tries to scare you into paying a fine to unlock your PC.
Windows 10 protects you from ransomware. Read more:
Windows 10 Creators Update provides next-gen ransomware protection
You can read more on our ransomware page.