Security
Ransomware or a locked computer
A ransom note, renamed files or a machine that will not open anything is an emergency measured in minutes — and every connected drive is in range.
Read before you start
Do not pay, and do not delete the encrypted files. Unplug the network first — ransomware keeps encrypting shared drives and cloud backups for as long as it stays connected.
This guide is for you if
- A note demanding payment sits on the desktop
- Files have strange extensions and will not open
- The machine boots to a message instead of the desktop
Step by step
Work top to bottom0 of 6 steps done
Disconnect it from everything
Unplug the network cable, turn off Wi-Fi, and unplug external drives, USB sticks and network storage. This is the single most useful thing you can do.
Cloud sync folders count as connected — pause or sign out of them from another device.
Leave it powered on, do not reboot
Some encryption keys live only in memory. Rebooting can destroy the chance of recovery, so unplug the network and leave the machine as it is.
Photograph the note and the file names
Take clear photos of the ransom screen, the file extensions and the time it started. Those details tell us which family it is and whether a decryptor exists.
Check your backups from another machine
Look at whether your backup drive was connected at the time. A backup that was plugged in is probably encrypted too — verify before trusting it.
Tell everyone else on the network
Other machines, shared folders and the office NAS are at risk. Disconnect them or shut them down until they can be checked.
Bring it to the bench before reinstalling
A rebuild is usually the answer, but we recover what can be recovered first and check the machine for the way in — otherwise it happens again next month.
Bring any external drives that were connected.