Some links on this page are affiliate links: if you buy through them we may earn a commission, at no extra cost to you.
Disconnect the infected computer from every network immediately, preserve the ransom note, clean the device, and only then attempt file recovery. Removing ransomware stops further encryption but does not automatically decrypt files. On a Windows home PC, use Windows Security’s full scan. If files remain locked, identify the ransomware family and use a trusted decryptor only when it specifically supports that family or variant; otherwise restore from a clean backup or available file history.
1. Isolate the computer first
Turn off Wi-Fi and unplug the Ethernet cable. Disconnect external drives, NAS devices and other removable storage that are not needed for evidence. Isolation limits access to shared folders and reduces the chance of the malware encrypting additional devices.
- Business, school or employer computer: contact the IT or security team and follow its incident-response instructions instead of attempting a network-wide cleanup yourself.
- Several computers, shared drives or synchronized folders affected: treat the event as a broader incident and involve qualified responders.
Do not automatically power off a managed computer. CISA notes that shutting down can prevent spread when network disconnection is impossible, but it can also destroy volatile evidence; Microsoft’s enterprise guidance recommends isolating compromised devices without turning them off where feasible. For a personal PC, use the least disruptive action that reliably cuts network access.
2. Preserve the evidence and ransom note
Photograph or screenshot the ransom message before deleting anything. Record the unusual file extension, the approximate start time, affected folders and any cryptocurrency address or contact details shown. Keep several encrypted files unchanged; do not rename, edit or delete them. These details can help identify the ransomware family and may be important to investigators.
#1 Best Overall
- NEVER WORRY about losing important files and photos again! With 25GB of secure online storage, you know your files are safe and sound.
- KEEP YOUR COMPUTER RUNNING FAST with our system optimizer. By removing unnecessary files, it works like a PC tune-up, so you can keep working smoothly.
- Our PASSWORD MANAGER by Last Pass creates, encrypts, and saves all your passwords, so you only have to remember one.
- As the #1 TRUSTED PROVIDER OF THREAT INTELLIGENCE, Webroot protection is quick and easy to download, install, and run, so you don’t have to wait around to be fully protected.
- STAY PROTECTED EVERYWHERE you go, at home, in a café, at the airport—everywhere—on ALL YOUR DEVICES with cloud-based protection against viruses and other online threats.
On an organizational system, avoid wiping or rebuilding machines before IT or incident responders have collected the evidence they need. Preserve relevant logs and affected systems when doing so is safe.
3. Clean a Windows PC before trying to recover files
Microsoft Support advises fully cleaning a Windows computer with Windows Security before attempting file recovery. On an offline personal PC, open Windows Security, choose Virus & threat protection, select Scan options, choose Full scan, and start the scan. Apply all offered remediation, restart if requested, then run another scan to confirm that no threat remains.
Rank #2
- THREAT DETECTION – Stay one step ahead. Suspicious links, risky sites, viruses, and scams, caught automatically before they reach you.
- PERSONAL INFO PROTECTION – Keep your personal info safer. Identity monitoring watches for your exposed info and tells you what to do about it.
- SECURE CONNECTIONS – Just a few easy clicks, and we'll automatically protect your info on public Wi‑Fi, every time you connect.
- GUIDED ACTION – Know what matters and what to do next. Clear alerts and simple guidance make it easy to take action.
- MORE THAN ANTIVIRUS – Scam protection, identity monitoring, VPN, web protection, and antivirus work together to protect you, all in one place.
- Use current security intelligence and Windows updates when you can do so safely after isolation; if the PC cannot update, have IT or a trusted technician provide the appropriate offline process.
- Do not assume one scan proves that every system is clean. Ransomware incidents can include stolen credentials, persistence, lateral movement or data theft.
- If folders were synchronized or mapped from another device, scan the other suspected devices and the systems hosting those shares before reconnecting anything.
For a company or multi-device incident, professional incident response may be required to determine scope, remove persistence, reset compromised accounts and prevent reinfection.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware match4. Understand what “removal” can and cannot do
Malware removal and file decryption are separate jobs. Removing the ransomware prevents it from encrypting more data, but it normally does not turn already encrypted files back into readable files. Do not delete the encrypted copies while you are determining whether a recovery method exists.
Rank #3
- STAY PROTECTED EVERYWHERE you go, at home, in a café, at the airport—everywhere—on ALL YOUR DEVICES, with cloud-based protection against viruses & other online threats
- Webroot PASSWORD MANAGER by Last Pass creates, encrypts, and saves all your passwords, so you only have to remember one.
- As the #1 TRUSTED PROVIDER OF THREAT INTELLIGENCE, you know you’re in good hands. Stay safe from viruses, ransomware, phishing, and more.
- Webroot SOFTWARE UPDATES ITSELF AUTOMATICALLY, so you always have the most current protection without lifting a finger—and updates happen in the background so they won’t slow you down.
- PREMIUM FEATURES: Encrypts & protects passwords and account information for all your devices so you can stay protected wherever you are.
5. Identify the ransomware and check for a legitimate decryptor
Use the ransom note, extension and a small sample of encrypted data to identify the family. The No More Ransom Project’s Crypto Sheriff can analyze submitted encrypted files and ransom-note information; its page lists a 1 MB maximum for submitted samples. Its decryptor catalogue contains tools for particular ransomware families, not a universal key.
- Use the identification service or another trusted public-service resource to establish the likely family.
- Check whether an official decryptor specifically names that family and, where stated, the relevant variant.
- Confirm that the computer has been cleaned before running the decryptor. Follow that tool’s instructions exactly and keep an untouched copy of encrypted files.
A family may have no decryptor, or a tool may not support the variant that infected you. Never install a program advertised as a universal ransomware unlocker or pay a stranger for a key without independent verification.
Rank #4
![Norton AntiVirus Plus, 1 Device, Auto-Renews [Download]](https://m.media-amazon.com/images/I/41VAV7G019L._SL160_.jpg)
- ONGOING PROTECTION Download instantly & install protection for your PC or Mac in minutes!
- ADVANCED SCAM PROTECTION Help spot hidden scams online. With the built-in Genie AI assistant, you’ll never wonder if a message or email is suspicious again.
- REAL-TIME PROTECTION Advanced security protects against existing and emerging malware threats, including ransomware and viruses, and it won’t slow down your device performance.
- SAFEGUARD YOUR PASSWORDS Easily create, store, and manage your passwords, credit card information and other credentials online in your own encrypted, cloud-based vault.
- 2 GB SECURE PC CLOUD BACKUP Help prevent the loss of photos and files due to ransomware or hard drive failures.
6. Recover files from a clean source
After cleanup, choose a recovery source that demonstrably predates the infection and has not been exposed to it. Verify the source before reconnecting it to the restored computer.
Recommended Free Tools
| Recovery path | Use it when | Important limitation |
|---|---|---|
| Offline or otherwise isolated backup | The backup predates the incident and can be checked as clean. | Backups left continuously accessible may also have been encrypted. |
| Windows File History | It was enabled before the attack and contains an earlier version of the files. | Availability and interface depend on the Windows version and configuration. |
| System Protection or previous versions | A supported Windows installation has usable restore points or shadow copies. | Ransomware may delete or encrypt local recovery data; it is not guaranteed. |
| Family-specific decryptor | The family and variant match a trusted tool’s documented support. | No tool is universal, and successful decryption is not guaranteed. |
For File History, use the Windows recovery controls to browse earlier versions and restore only after the machine is clean. Exact labels differ by Windows release. If OneDrive or another cloud service was syncing during the incident, pause synchronization first and investigate the provider’s version history or restore function; resuming sync from an infected device can propagate encrypted changes.
Best Value
- NEVER WORRY about losing important files and photos again! With 25GB of secure online storage, you know your files are safe and sound.
- KEEP YOUR COMPUTER RUNNING FAST with our system optimizer. By removing unnecessary files, it works like a PC tune-up, so you can keep working smoothly.
- Our PASSWORD MANAGER by Last Pass creates, encrypts, and saves all your passwords, so you only have to remember one.
- As the #1 TRUSTED PROVIDER OF THREAT INTELLIGENCE, Webroot protection is quick and easy to download, install, and run, so you don’t have to wait around to be fully protected.
- STAY PROTECTED EVERYWHERE you go, at home, in a café, at the airport—everywhere—on ALL YOUR DEVICES with cloud-based protection against viruses and other online threats.
7. Do not rely on ransom payment
Microsoft and No More Ransom advise against paying. Payment does not guarantee a working decryptor, restored access or deletion of stolen data, and it can encourage further attacks. If you have already paid or shared financial information, contact your bank and local authorities promptly. Organizations should also report the incident through the appropriate law-enforcement and national cybercrime channels; CISA recommends federal law-enforcement contact for organizational incidents and possible decryptors.
When to stop DIY cleanup
- More than one computer, server, NAS or shared drive is affected.
- You see signs of account takeover, data theft or continued encryption after scanning.
- The device contains business, medical, financial or legally significant evidence.
- You cannot safely isolate the computer or verify that a backup is clean.
In these cases, leave systems isolated, document what happened and engage your IT team or an established incident-response professional. Avoid reinstalling or deleting evidence until responders advise you.
After recovery: prevent a repeat incident
- Maintain offline, encrypted backups and test that files can actually be restored. Keep backup storage disconnected when it is not being used.
- Protect administrator and remote-access accounts with unique passwords and multifactor authentication where available.
- Keep operating systems, browsers, applications and security tools updated.
- Limit write access to shared folders and remove unused remote-access software.
- Teach users to verify unexpected attachments, links and login prompts.
An external hard drive can be part of an offline-backup plan, but it does not remove malware or recover files by itself. Disconnect it whenever a backup is not actively running, and never connect it to a computer that may still be infected.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
