I've been battling this malware all day. It is a typical popup that has "Windows has been blocked" and "Call this number" but it has a delayed cmd prompt that runs from the program data folder mentioned above. Then it pops up in the browser. (node.js serverside java script...
