Removing Ransomware

Issue/Question

A message has appeared on my computer that says it's infected with a virus.  I cannot close the message, and it instructs me to call a number for support.

Cause

Ransomware is a form of malware that essentially holds the user's computer "hostage," and tries to coax the user into following provided instructions to resolve the issue (this typically involves paying money).  Ransomware may look official (Windows/Microsoft logos, clean interfaces) and come across as rather menacing.

Resolution

Most ransomware is confined to the Internet browser that the user was using when it appeared.  In those cases, closing the browser will resolve the issue.  However, it is recommended that the machine be rebooted entirely to ensure that any open processes are fully exited.  Follow the normal steps to shut down the machine; if the ransomware prevents you from accessing your machine's shut down panel, perform a hard shutdown, by holding in the power button.

If the ransomware message does not appear after rebooting the machine and opening the browser, the machine may not be not be infected.  If the message does re-appear, or appears without opening the browser, the machine is infected and you will need to contact the ITS Service Desk.

Details

Article ID: 2516
Created
Thu 1/12/17 1:28 PM
Modified
Mon 11/28/22 10:40 AM