Files locked by ransomware: what to do now

Signs of ransomware include files that will not open and have a new, strange extension, and a text file or full-screen message demanding payment, often in cryptocurrency. Some fake "ransomware" pop-ups in a browser are just scare pages; if your files still open normally, see fake virus alerts instead.

1. Disconnect immediately

   Turn off Wi-Fi or unplug the network cable. Unplug USB drives and external backup drives. Ransomware can spread to shared folders and connected drives, including your backups.

   Do not turn the PC off yet if you can avoid it, as some recovery tools rely on information still in memory. If the encryption is visibly still spreading, shutting down is better than letting it continue.

2. Do not pay

   Paying does not guarantee you will get your files back, marks you as a willing payer for future attacks, and funds criminal groups. Law enforcement agencies in the US, UK and EU all advise against paying.

3. Record what you see

   Take photos of the ransom message with your phone, and note the new file extension your files have, for example report.docx.locked. You will need these details to identify the ransomware and to report it.

4. Check for a free decryption tool

   From a different device, visit nomoreransom.org, a project run by Europol, police agencies and security companies. Its Crypto Sheriff page identifies the ransomware from a sample file or the ransom note, and links to a free decryptor if one exists. Use only tools linked from that site.

5. Report the attack

   • US: the FBI's Internet Crime Complaint Center at ic3.gov.
   • UK: Action Fraud, or Police Scotland in Scotland.
   • Elsewhere: your national police cybercrime unit.

   If it is a work computer, tell your IT team or employer at once. Businesses may have legal duties to report data breaches.

6. Clean the PC before restoring anything

   Restoring files onto an infected PC can get them encrypted again. Run a full scan and an offline scan. The safest option is usually Reset this PC with Remove everything, under Settings, then System, then Recovery. That deletes the encrypted files too, so copy them to a separate drive first in case a decryptor appears later.

7. Restore your files

   • External backup drive: reconnect it only after the PC is clean, then copy files back.
   • OneDrive: Microsoft 365 subscribers can use Restore your OneDrive in OneDrive settings to roll files back to a date before the attack. Others can restore individual files from their version history.
   • Other cloud storage: most services keep earlier versions of files for a period of time.

8. Protect yourself next time

   • Turn on Controlled folder access: Windows Security, then Virus & threat protection, then Manage ransomware protection.
   • Keep one backup that is disconnected from the PC when not in use.
   • Install Windows and app updates promptly, and be wary of email attachments you were not expecting.