Ransomware on your home computer

The screen wants money, usually in cryptocurrency, and your documents will not open. Unplug the computer from the network before you do anything else. Do not pay the note.

This guide is for a home computer. If the machine is a company system, or it holds customer data, use Ransomware or destructive malware once the network cable is out. The household version is Ransomware on a home computer.

The FBI’s page is Ransomware. They say you often find out when you cannot open your data, or when a message demands payment. It can arrive as an attachment, an ad, a link, or a site carrying malware. They do not support paying. Victims who paid have still not received keys. Paying also tells other criminals the attack works.

Europol says the same, in plainer language for home users, through No More Ransom. Their line is that there is no guarantee of a key, and that paying makes you a likelier target again.

The first hour

1. Disconnect Wi-Fi and unplug ethernet. No More Ransom says to cut the network as soon as you see a rogue process, so it has a harder time reaching other devices and disks.
2. Do not chat with the address on the note, and do not send coins. A tech-support pop-up with a phone number is the same trap. Do not call it.
3. Photograph the whole note. Include any address, deadline, and the extension on your files. You will want that picture if a free decryptor exists.
4. Unplug backup drives. If one was connected, it may already be encrypted. If it was not, leave it unplugged until the computer is clean.
5. Stop using the machine. Rebooting and “trying one file” can encrypt more, and can overwrite something a decryptor needed.

If the encrypted folder is also a cloud-sync folder, the damaged copies may be replacing the good ones on your other devices. Pause sync on those devices. That mess is Cloud sync deletes files everywhere.

Decryptor first, wipe later

Go to nomoreransom.org yourself. Do not use a link from the ransom note. Europol describes the Crypto Sheriff: you upload two encrypted files and the note, it checks them against known tools, and a match gives you the tool and the instructions. If nothing matches, they say to check again later. Tools get added. There is not a tool for every ransomware family. Their overview is the Europol No More Ransom guide.

Cleaning comes next, and it is not the same as unlocking. No More Ransom says antivirus removes the program so it cannot encrypt new files. Your locked documents stay locked. They mention that you may need Safe Mode to run the scan. Use your antivirus vendor’s own instructions for that, not a cleaner from an ad.

If you have a backup that was offline during the attack, restore only after the computer is clean, or restore onto a system you reinstalled. Open one restored file and confirm it is the real document.

If you have no backup, many of those files stay encrypted. Copies may still exist in email, on an old phone, or on a disk you forgot. Photos and files lost with no backup is the honest hunt. It will not conjure a decryptor.

Who to tell

No More Ransom says to report it to your national police. In the United States, the FBI says to contact a local field office or file at ic3.gov. Include the note, the date, and how you think it arrived. A report does not unlock the disk. It is how cases get built.

Change your passwords from a different device. The infected computer is a bad place to type your email password. Start with email, then the bank, then anything the browser on that PC had saved.

If you already paid, because the note scared you, stop there. Do not pay a second “recovery” demand. Crypto you sent is covered in Cryptocurrency wallet drained. The FTC’s position is that a crypto payment comes back only if the recipient sends it back.

If it was a work computer

Disconnecting and not paying still apply. After that, your employer needs to know, especially if other people’s data was on the disk. Their duties, evidence, and whether to notify anyone are in the business playbook. Do not announce “no data was taken” because the files look locked. Locking and theft can be the same attack. The FBI describes both.

When you can trust the computer again

It is reinstalled, or your antivirus says the ransomware is gone and new files are not being encrypted. A restored document opens. The backup disk stayed unplugged until that was true. You did not send the payment.

Then make the backup you wish you had had. No More Ransom’s advice for home users is two copies, one in a cloud service that keeps versions, and one on a disk you disconnect when the copy finishes. Prove it by restoring a folder onto a different folder, not over the originals. That test is the prepare section of Ransomware on a home computer. Do it on a clean machine, this week, while you still remember the note.

Related playbooks

• Ransomware on a home computer. A home computer locked your files or the screen and is demanding payment. This is the household version, not a company network.
• Photos and files lost with no backup. The drive died, the phone went in the water, or the folder is simply gone, and there was never a copy.
• Cloud sync deletes files everywhere. A deletion, bad edit, or damaged folder is copied across every device connected to your cloud storage.
• Ransomware or destructive malware. Systems or data are encrypted, stolen, deleted, or held for payment by a malicious actor.