One method of tackling the problem is to bott into Safe Mode, restore to an uncontaminated Safe Point, reboot, and then use Malwarebytes and/or other malware removal tools to cleanup the malware. Unfortunately, some variants of Ransomware hide on the computer’s hard drive and/or BIOS/EUFI and restores itself after the cleanup, so when you go to boot the computer the next time or some later time the ransomware disables the computer even more by disabling Safe Mode. The computer either goes into a full boot and presents the ransomware message, or the computer cannot be booted into the operating system.
The next step is to use the BIOS setup utilities or another computer that can deal with malware infections to reformat the hard drive and reinstall the operating system. This will often remove the malware for awhile. However, in some instances the ransomware even managed to restore itself immediately after the hard drive had been reformatted and the operating system was reinstalled. Presumably, it did so by hiding enough code on a hidden sector of the hard drive not affected by the reformatting or in the system BIOS/EUFI to bootstrap itself back into the reinstalled operating system. The next attempt to remove this ransomware on these systems resulted in the ransomware blocking any and all efforts to bott the computer at all, whether it was to a full boot, boot to Safe Mode, or a boot to the system BIOS/EUFI.
The next step which has not yet been attempted is to use another used hard drive I can afford to lose and install it as a new hard drive on one of the affected computers. If the ransomware was hidden on an inaccessable area of the original hard drive, replacing the hard drive should be effective in removing the ransomware. However, if the ransomware is hidden in a corrupted BIOS/EUFI, I can expect to see the ransomware infect the replacement hard drive as well and hijack the operating system again, if it will allow the boot process to get even that far.
Your computer is probably repairable by reformatting the hard drive or at least by replacing the hard drive. But don’t be too surprised if you should be unlucky enough to have encountered one of the more vicious and persistent of the ransomware variants. In the worst case scenario with an infection of the BIOS/EUFI, you’ll have to find a means of restoring an uninfected BIOS/EUFI or abandon the ssytem board.
It hides in the boot sector which usually isn’t reformatted unless you do it using 3rd party tools. You’d probably have to run like a fdisk /mbr to clean it the old fashioned way.