What is ransomware?

Ransomware is a type of malware that stops you from using your PC until you pay a certain amount of money (the ransom). It is often called "FBI Moneypa " or the "FBI !irus" as it often uses the FBI or local police logos and as s you to pay using "reen #ot MoneyPa . There are two types of ransomware. $oc screen ransomware % which uses a full%screen image or we&page to stop you from accessing anything on your PC. 'ncryption ransomware % which loc s your files with a password( stopping you from opening them. Most ransomware shows a notification that says your local authorities ha!e detected illegal acti!ity on your PC. )hey then demand you pay a "fine" to a!oid prosecution and to get access to your files again. Note* Microsoft doesn+t recommend you pay the fine. )here is no guarantee that paying the ransom will return your PC to a usa&le state. )he threat of prosecution does not come from a legitimate authority. There is more information about removing a ransomware infection below.

',amples of ransomware

)ro-an*.in/01)ras&ind.2 )ro-an*.in/01)ras&ind.2

)ro-an*.in/01Re!eton.C )ro-an*.in/01Re!eton.C

)ro-an*.in/01Porchanspi.2 )ro-an*.in/01Porchanspi.2

Frequently asked questions

Is it true that the legal authorities in my area have detected illegal activities in my !?

3o. )hese warnings are fa e and ha!e no association with legitimate authorities. )he operators of ransomware use the tone( images and logos of legal institutions to gi!e their scam an air of legitimacy.
I cannot access my ! or my files. "hould I #ust go ahead and pay to regain access?

.e don+t recommend you pay the fine. )here is no guarantee that handing o!er the ransom will gi!e you access to your files again. Paying the fine could also ma e you a target for more malware.
What should I do if I$ve paid the scammers?

4ou should contact your &an and your local authorities( such as the police. If you paid with a credit card( your &an may &e a&le to &loc the transaction and return your money. )he following go!ernment%initiated fraud and scam reporting we&sites may also help*

In 2ustralia( go to the 5C2Mwatch we&site In Canada( go to the Canadian 2nti%Fraud Centre In France( go to the 2gence nationale de la s6curit6 des syst7mes d8information we&site In "ermany( go to the Bundesamt f9r 5icherheit in der Informationstechni we&site In Ireland( go to the 2n "arda 5:och;na we&site In 3ew <ealand( go to the Consumer 2ffairs 5cams we&site In the =nited >ingdom( go to the 2ction Fraud we&site In the =nited 5tates( go to the ?n "uard ?nline we&site

If your country or region isn8t listed here( we encourage you to contact your country8s federal police or communications authority. For general information on what to do if you ha!e paid( see*

.hat to do if you are a !ictim of fraud

%ow did the scammers know my I address?

)here are pu&licly a!aila&le tools online that can chec a computer8s IP address. "etting IP addresses is a common &eha!ior for malware % in the case of ransomware( it+s used as another scare tactic.
%ow did ransomware get on my !?

Ransomware( li e other malware( can arri!e in a !ariety of ways. @owe!er( in most instances it is automatically downloaded when you !isit a malicious we&site or a we&site that8s &een hac ed.
%ow do I regain access to my computer or files?

Ransomware ha!e different &eha!iors and ha!e to &e remo!ed in different ways. )here is more help on remo!ing an infection &elow.

%ow do I protect myself against ransomware?

#espite its threatening nature( ransomware is still a type of malware. .e recommend the same tips to help eep any malware out of your PC*

Install and use an up%to%date anti!irus solution (such as Microsoft 5ecurity 'ssentials) Ma e sure your software is up%to%date (here8s a short list of common software) #on8t clic on lin s or open attachments from untrusted sources

5ome ransomware may lea!e your PC or files in an unusa&le state. .e recommend you regularly &ac up your important files. 4ou can do this with a cloud storage ser!ice such as 5 ydri!e( which is now fully integrated into .indows A and Microsoft ?ffice.

%ow do I remove a ransomware infection from my !?

)he following two methods might help you remo!e a ransomware infection from your PC.

&ethod '( )se the &icrosoft "afety "canner Before you &egin( you will need to ha!e access to a PC that is not infected and is connected to the Internet so that you can download a copy of the Microsoft 5afety 5canner. )ry to restart your computer in safe mode. @ere8s how*
o o o o

In .indows A In .indows B In .indows Cista In .indows DP

If you can+t restart your PC in safe mode( run the Microsoft 5afety 5canner and restart your PC afterwards. If this resol!es your ransomware infection( there are a few steps you should ta e once your PC has &een cleaned. If this does not resol!e your ransomware infection( follow Method 0.

&ethod *( )se Windows +efender ,ffline If you+!e tried the Microsoft 5afety 5canner and uninstalling then reinstalling your antimalware software and you+re still ha!ing an issue( we recommend you download and run .indows #efender ?ffline. .indows #efender ?ffline is a standalone tool with the latest antimalware updates from Microsoft. It+s not a replacement for a full anti!irus or antimalware solution that pro!ides ongoing protection. It+s meant to &e used when you can+t start or scan your PC &ecause a malware infection is stopping your security software from wor ing. Before you &egin you will need*
o o

2 PC that is not infected and is connected to the Internet. 4ou will use this PC to download a copy of .indows #efender ?ffline. 2 &lan C#( #C# or =5B flash dri!e % use this to run the tool on your infected PC.

Follow these steps to use .indows #efender ?ffline*

1.

=se an uninfected PC to download a copy of the tool from here* .indows #efender ?ffline Ma e sure you download the right !ersion for your PC. For e,ample( your des top PC has &een infected with malware. It is running a EF%&it !ersion of .indows. 4our friend8s laptop( howe!er( is not infected( and so you use that to download .indows #efender ?ffline. 4our friend8s laptop is running a /0%&it !ersion of .indows( so when you download the tool you choose the EF%&it !ersion &ecause that is the !ersion that matches your des top PC.

2. 3. 4.

Install the tool on a &lan C#( #C#( or =5B flash dri!e. Insert the C#( #C#( or =5B flash dri!e into your infected PC and run the tool. $et the tool clean your PC and remo!e any infections it finds.

2fter running the tool( ma e sure your antimalware software is up%to%date. 4ou can update Microsoft security software &y downloading the latest definitions. For detailed instructions on using .indows #efender ?ffline( see the Microsoft 5ecurity Blog post Microsoft8s Free 5ecurity )ools % .indows #efender ?ffline. "teps you can take once your ! has been cleaned

If you+re running .indows A( your PC comes with .indows #efender &uilt in. .indows #efender helps guard your PC against !iruses( spyware( and other malicious software in real time. If you+re running .indows B or .indows Cista( install security software( such as Microsoft 5ecurity 'ssentials or other security software that pro!ides a complete( real%time antimalware solution. >eep your antimalware software up%to%date &y ma ing sure you ha!e the latest definitions

I want to... Remo!e malware Remo!e difficult malware Remo!e FBI1police loc screen 5ee and search the latest threats 2nswer common Guestions - Fi. my software Fi, update pro&lems 5ee common error codes 2nswer common Guestions

+ownload and update

"et the latest updates Find the right security software

#ownload security software

"ubmit a file

5end us a malware file #ispute a detection Report a false positi!e

o o o o o o o o o o o o o o o o o o

+ownloads
#ownload Center .indows downloads ?ffice downloads

"upport
5upport home >nowledge &ase Microsoft community

/bout
)he MMPC '!aluating our protection MMPC Pri!acy 5tatement Microsoft Careers CitiHenship Company news In!estor relations 5ite map

opular resources
5ecurity and pri!acy &logs 5ecurity Response Center 5ecurity Intelligence Report Microsoft 5afety I 5ecurity Center Malware Protection Center 5ecurity for I) Pros 5ecurity for de!elopers )rustworthy Computing