Ransom:Win32/Reveton
Microsoft Defender Antivirus detects and removes this threat.
This threat locks your PC and displays a full-screen message, commonly called a "lock screen".
It pretends to be from the FBI or a national police force and tries to scare you into paying a fine to unlock your PC.
Typically, this threat gets on your PC when you visit a hacked webpage.
Our ransomware FAQ page has more information on this type of threat.
The trend towards increasingly sophisticated malware behavior, highlighted by the use of exploits and other attack vectors, makes older platforms so much more susceptible to ransomware attacks. From June to November 2017, Windows 7 devices were 3.4 times more likely to encounter ransomware compared to Windows 10 devices.
Read our latest report: A worthy upgrade: Next-gen security on Windows 10 proves resilient against ransomware outbreaks in 2017.
Ransom:Win32/Tescrypt
Windows Defender detects and removes this threat.
This ransomware can stop you from using your PC or accessing your data. It might ask you to pay money to a malicious hacker.
See the Win32/Tescrypt ransomware family description for more information.
As of April 2015, we have observed an increase in Tescrypt activity as it gets dropped by a few exploit kits such as Exploit:SWF/Axpergle (Angler), Exploit:JS/Neclu (Nuclear), JS/Fiexp (Fiesta), and JS/Anogre (Sweet Orange).
Our ransomware page has more information on this type of threat.
Ransom:Win32/Tescrypt.R
Windows Defender detects and removes this threat.
This ransomware can stop you from using your PC or accessing your data. It might ask you to pay money to a malicious hacker.
Our ransomware page has more information on this type of threat.
Ransom:JS/CryptoRaa.A
Windows Defender detects and removes this threat.
The threat renames and encrypts some files on your PC. It might ask you to pay money to a malicious hacker.
Our ransomware FAQ page has more information on this type of threat.
Read our latest report: Ransomware 1H 2017 review: Global outbreaks reinforce the value of security hygiene.
Ransom:Win32/Urausy.C
Windows Defender detects and removes this threat.
This threat locks your PC and displays a full-screen message, commonly called a "lock screen". If this threat asks you to pay a fee or fine, do not pay it. The message is a fraud.
It pretends to be from the FBI or a national police force and tries to scare you into paying a fine to unlock your PC.
Typically, this threat gets on your PC when you visit a hacked webpage.
You can read more about this type on malware at the Ransom:Win32/Urausy family description or on our ransomware page.
Ransom:Win32/Empercrypt.A
Windows Defender detects and removes this threat.
This ransomware can stop you from using your PC or accessing your data. It might ask you to pay money to a malicious hacker.
Our ransomware page has more information on this type of threat.
Ransom:Win32/Genasom.GC
Microsoft Defender Antivirus detects and removes this threat.
This threat stops you from loading Windows and displays a full-screen message, commonly called a "lock screen". If this threat asks you to pay a fee or fine, do not pay it. The message is a fraud.
It tries to scare you into paying a fine to unlock your PC.
You can read more on our ransomware page.
The trend towards increasingly sophisticated malware behavior, highlighted by the use of exploits and other attack vectors, makes older platforms so much more susceptible to ransomware attacks. From June to November 2017, Windows 7 devices were 3.4 times more likely to encounter ransomware compared to Windows 10 devices.
Read our latest report: A worthy upgrade: Next-gen security on Windows 10 proves resilient against ransomware outbreaks in 2017.
Ransom:Win32/Genasom.OPY
Microsoft Defender Antivirus detects and removes this threat.
This threat stops you from loading Windows and displays a full-screen message, commonly called a "lock screen". If this threat asks you to pay a fee or fine, do not pay it. The message is a fraud.
It tries to scare you into paying a fine to unlock your PC.
You can read more on our ransomware page.
The trend towards increasingly sophisticated malware behavior, highlighted by the use of exploits and other attack vectors, makes older platforms so much more susceptible to ransomware attacks. From June to November 2017, Windows 7 devices were 3.4 times more likely to encounter ransomware compared to Windows 10 devices.
Read our latest report: A worthy upgrade: Next-gen security on Windows 10 proves resilient against ransomware outbreaks in 2017.
Ransom:Win32/Genasom.JV
Microsoft Defender Antivirus detects and removes this threat.
This threat stops you from loading Windows and displays a full-screen message, commonly called a "lock screen". If this threat asks you to pay a fee or fine, do not pay it. The message is a fraud.
It tries to scare you into paying a fine to unlock your PC.
Our ransomware FAQ page has more information on this type of threat.
The trend towards increasingly sophisticated malware behavior, highlighted by the use of exploits and other attack vectors, makes older platforms so much more susceptible to ransomware attacks. From June to November 2017, Windows 7 devices were 3.4 times more likely to encounter ransomware compared to Windows 10 devices.
Read our latest report: A worthy upgrade: Next-gen security on Windows 10 proves resilient against ransomware outbreaks in 2017.
Ransom:Win32/Ergop.A
Microsoft Defender Antivirus detects and removes this threat.
This ransomware can stop you from using your PC or accessing your data.
It encrypts files and uses .707, .725, .726, .astra, .crypt, .ocean, or .txt as file name extension for encrypted files. It leaves a ransom note with the file name how_open_files.hta, RECOVER-FILES.html, or !back_files!.html.
Our ransomware FAQ page has more information on this type of threat.
The trend towards increasingly sophisticated malware behavior, highlighted by the use of exploits and other attack vectors, makes older platforms so much more susceptible to ransomware attacks. From June to November 2017, Windows 7 devices were 3.4 times more likely to encounter ransomware compared to Windows 10 devices.
Read our latest report: A worthy upgrade: Next-gen security on Windows 10 proves resilient against ransomware outbreaks in 2017.
Ransom:Win32/Genasom
Microsoft Defender Antivirus detects and removes this threat.
This threat stops you from loading Windows and displays a full-screen message, commonly called a "lock screen". If this threat asks you to pay a fee or fine, do not pay it. The message is a fraud.
It tries to scare you into paying a fine to unlock your PC.
Our ransomware FAQ page has more information on this type of threat.
The trend towards increasingly sophisticated malware behavior, highlighted by the use of exploits and other attack vectors, makes older platforms so much more susceptible to ransomware attacks. From June to November 2017, Windows 7 devices were 3.4 times more likely to encounter ransomware compared to Windows 10 devices.
Read our latest report: A worthy upgrade: Next-gen security on Windows 10 proves resilient against ransomware outbreaks in 2017.
Ransom:Win32/Reveton.N
Microsoft Defender Antivirus detects and removes this threat.
Ransom:Win32/Reveton.N is ransomware that demands a fine for the supposed possession of illicit material or unauthorized online activities. It displays a full screen image, localized according to your location, with payment instructions. Read more about ransomware on our Ransomware page.
Our ransomware FAQ page has more information on this type of threat.
The trend towards increasingly sophisticated malware behavior, highlighted by the use of exploits and other attack vectors, makes older platforms so much more susceptible to ransomware attacks. From June to November 2017, Windows 7 devices were 3.4 times more likely to encounter ransomware compared to Windows 10 devices.
Read our latest report: A worthy upgrade: Next-gen security on Windows 10 proves resilient against ransomware outbreaks in 2017.
Ransom:Win32/Nobig
Microsoft Defender Antivirus detects and removes this threat.
This ransomware can stop you from using your PC or accessing your data. It might ask you to pay money to a malicious hacker to restore your files.
This ransomware is distributed though spam emails with malicious document attachments.
Our ransomware FAQ page has more information on this type of threat.
The trend towards increasingly sophisticated malware behavior, highlighted by the use of exploits and other attack vectors, makes older platforms so much more susceptible to ransomware attacks. Trends show that Windows 7 devices are more likely to encounter ransomware compared to Windows 10 devices.
Read our latest report: A worthy upgrade: Next-gen security on Windows 10 proves resilient against ransomware outbreaks in 2017.
Ransom:Win32/Grymegat.A
Ransom:Win32/Grymegat.A is a ransomware that locks your PC and displays a webpage that covers your desktop. This webpage demands the payment of a fine for the supposed possession of illicit material.
The trojan might make lasting changes to your PC that make it difficult for you to download, install, run, or update your virus protection. For specific recovery information, please see the relevant variant's entry in the encyclopedia and the Additional recovery instructions in this entry.
For more information on ransomware, please see our FAQ on ransomware.