Avira is reporting a new and disturbing malware sample which overwrites the MBR and replaces it with a ransom request.
The MBR ransomware is downloaded and installed by a Trojan of the Oficla family. When you reboot after it overwrites the MBR you are presented with the screen. The claim that all the hard drives were encrypted is a lie and you don't have to go to their web site for a password. The password "aaaaaaciip" restores the original MBR so that Windows will start again on all affected systems.
Posts
