Comments (32)

  1. Eddy Current says:

    Why should someone with a sane mind upgrade to Windows 10?
    Even Microsoft latest OS fails to employ W^X in its filesystem and allows execution of any file anywhere.

    JFTR: NTFS was introduced about 25 years ago and supports fine-grained access control, including a permission “execute file”. Apply an ACE (D;OIIO;WP;;;WD) on every directory where user’s can (over)write files (typically the user’s profile plus C:\ProgramData\), and the attack vector is closed.

    JFTR: SAFER alias software restriction policies were introduced about 15 years ago. See for guidance written by some obscure company which goes by the name Microsoft

  2. MrMinz says:

    Thanks for the Warning. But how will OneDrive Business and Windows10 protect me from infected USB Drives and infected spam mails?

    1. Steve says:

      OneDrive for Business have version history so you can revert files and Windows 10 have the last security updates.

      1. Phreeze says:

        Win7 does have the latest updates too…and those updates do not protect at all…look at how the malware works,no update at all can protect you.

        1. billert says:

          Well, technically Windows 7 only has Extended support. The Windows 7 extended support ends on January 14, 2020 based on Microsoft Support Lifecycle. However, if you upgrade to Windows 10, your PC’s support will end September 14, 2025.

  3. really?... says:

    really? ugrade to windows 10?
    use one drive for bussines?
    use micro$oft Edge browser?
    use windows Defender?

    this article is more like an advertisement cloaked in a warning article about ransomware.

  4. Christoph says:

    Well thanks, the info i am missing:
    – I guess I should be 100% sure to have disabled the malware before restoring (if not I suppose my backup drive is the next encrypted thing)
    – how can I disable auto run / autorun.inf on removable drives (one of the most dangerous things there ever was in IT history)? Will this still work in Win10?

    best regards, Christoph

  5. You should also include an MD5 or some other hash for the file(s) involved–to help users.


    1. msft-mmpc says:


  6. Meitzi says:

    MrMinz: I think the idea is that OneDrive has versionhistory. So you just restore older versions.

    1. king says:

      Realistically, a lot of the top well known business won’t be using OneDrive for business or moved on to Windows 10 yet. Also, version history is not something new and unique to OneDrive.

  7. Jim says:

    I can see that Windows Defender / SCEP can detect this Malware, but I do not see it stated that it can REMOVE this threat upon detection.
    If it can be removed, what is the version number of the definition file needed to protect myself?

    1. msft-mmpc says:

      Please make sure that the signatures/definitions are up to date and this threat should be removed.
      You can see the change log for the definition updates and download the latest definition updates from this link

  8. Elizabeth says:

    Hi, Thanks for this info.
    I have a few questions . Windows 7 Pro 32 bit sp1. Will get windows 10 when able to purchase new PC . This one has run for 15 years and been completely reconfigured in 2008.
    1] MSE antivirus disabled my windows 7 defender. Should I turn it back on?
    2 ] I also use MBAM . Is this alright and helpful?
    3[ VIP….I went to your link above….LINK ( LNK ) TO RANSOM and found the radar says Severe. Does this reflect my windows 7 sp1 C 32 bit or is it only an example?
    5] Should I go to C: system 32 and if I see / ZCRYPTOR ,, do I delete it. Also do I delete this file. ,
    C: users…..apt data ..roaming if found there do I delete from all users s well?
    6] Do I adjust the registry if found there as shown above? How?
    Thanks for your help, Liz

  9. Fix my bouncing screen that appeared several days ago.

  10. Mike says:

    Shameless plug…

  11. adwbust says:

    LOL MSE can’t even fully clean lnk files created by malware on a usb drive. 🙂

    A yeltminky on a usb drive was there for months or maybe even a year before it was even detected.

    Funny how you have charts/graphs of how many machines were “cleaned” when most definitely those machines aren’t clean and there are remnants – undetected items by your mmpc engine lol.

  12. underground says:

    cual es el counter de valor fildelsticks ja ja (equisde)

  13. T T says:

    defender is unable to delete the Trojans/viruses. what can be done?

  14. I keep getting this Internet page on my screen and it seems I can’t do anything to stop it.
    I think it’s a Russian site (?)

    The site comes up even if I’m not using any browser. In this case Windows Edge. It’s disturbing because the page continues a video and suddenly the computer starts talking and it tookm me a while to see it was due to that page.

    Hope you can do something to prevent this from happening.

    Sincerely yours
    Thomas H

  15. gilles boisjoly says:

    Is this really from you ???………..Microsoft Account Confirmation (see below)

    We received a request from you yesterday to terminate your account permanently
    and the process has started by our automated server

    If you didn’t request this, click the button below to cancel the request immediately.

    cancel request

    If you actually request to delete your account, please ignore this email

    Microsoft account team

  16. I cannot delete all the malware after having done a full scan Why not?

  17. bev beaman says:

    My pc started normally. I went to play at and I got this message saying to call a certain 1-888 number to reach Microsoft
    before I did any purchases or banking on my account. I immediately tried to close it but it did not work. I then went to task manager but they could not close it either so I started a full scan with security essentials.. The file in task manager says atiedxx 00 1,836

  18. Raul Lozano says:

    en español porfavor

  19. peter says:

    maybe a microsoft conspiracy? upgrade to win 10, use ms edge….upgrade to win 10, use ms edge….upgrade to win 10, use ms edge….and on and on it goes!

  20. GuerreroCanino says:

    **** that namsonware, its already enough with the normal namsonwares.

  21. This is too hitech for me I am a senior user. Email is a problem neither delivering of sending mail Has error messages.

  22. CeeCee says:

    Malware, Windows defender is available but your updates are not available for ransome to support infectious-ware…
    Window updates applicable but support minimul productivity….

Skip to main content