Grover has a popup that says to call Microsoft Support. Has he been bit by ransomware? Leo says no, probably not. It's a phishing attack, but it's to try and get him to call in and then they charge him and access his computer. It's Scareware, really. He can ignore it, but it keeps popping up and he has to reboot his system to get rid of it. He even replaced the hard drive, but it didn't help.
Leo says that it sounds like a browser hijack, and when Grover backed up his data, he backed up the malware as well. He should make sure to run as a limited, standard user. That will keep the browser hijack from reinfecting him. The chatroom says that Google Chrome will sync his extensions, and if he has a bad extension, Chrome will backup and sync that as well. So that may be where Grover is getting reinfected.