A virus recently identified here does some scary work to a user's data; after encrypting files, it places a pop-up message with contact information describing how to buy back access to the encrypted data.
It is advised in this case not to restart or power down the affected machine.