Ransomware with this disk-level encryption will cause a computer to reboot after replacing the existing master boot record. Then, the computer will display a screen masquerading as a checkdisk scan.