Ransomeware is serious stuff when it happens.
However
Our techs tell me over 90% of the 'ransomeware' calls they handle are simply hacked browsers telling the user their data is locked (and a phone number to call to unlock it).
Putting a browser in kiosk mode and disabling the mouse click events will scare many users.
Killing the browser (sometimes not so easy to do) results in a normal system, after a scan.
I had to do this once when they got shorthanded.
The user was totally convinced they were locked out of the system.

Make your sound your own!
.. I do not work here, but the benefits are still awesome