PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchIf ransomware is encrypting systems or threatening to publish data, do not begin by replying to the ransom note. First activate your approved incident-response plan, contain the intrusion without destroying evidence, move coordination to communications the attacker cannot monitor, and bring in qualified responders, counsel, your insurer, and appropriate authorities. Only after those steps should your organization evaluate any communication or negotiation strategy. CISA’s central instruction is direct: “Should your organization be a victim of ransomware, follow your approved IRP.”
What to do first: the defensible sequence
This guidance is for organizations and the people running their incident response. A ransomware event can involve encryption, data theft, stolen credentials, persistence, and continued access at the same time. Treat the ransom note as one piece of evidence, not as a command to start a conversation.
As an Amazon Associate I earn from qualifying purchases.
- Activate the approved incident-response plan (IRP). Identify the designated incident commander and crisis-response team, and use the hard-copy or offline version of the plan if normal systems are unavailable.
- Contain the spread in a coordinated way. Identify affected hosts, accounts, subnets, cloud resources, and business services. Isolate them from the rest of the environment.
- Change how the team communicates. Use out-of-band phone calls or another trusted channel. Assume email, chat, shared drives, and conference systems may be monitored or compromised.
- Preserve volatile evidence before shutdown. Disconnect network access where feasible, but avoid casually powering off systems because memory and other infection artifacts can disappear.
- Engage responders and stakeholders. Bring in internal IT and security, leadership, legal counsel, communications, the cyber insurer, and any managed security or incident-response provider already covered by your plan.
- Report through the right channels. For a U.S. incident, consider CISA, the local FBI field office, FBI Internet Crime Complaint Center (IC3), and a local U.S. Secret Service field office. Outside the United States, use the relevant national cyber authority and law-enforcement channels.
- Decide on recovery and any attacker contact only with qualified advice. Payment is not a recovery guarantee, and CISA, the FBI, and NSA strongly discourage paying ransom.
The order matters. A rushed reply can reveal that the organization is disorganized, destroy negotiation leverage, expose staff to further social engineering, or interfere with forensic and legal work.
Activate the incident-response plan and crisis command
Use the plan you already approved
Start with the organization’s written IRP, not an improvised ransom-note checklist. The joint CISA #StopRansomware Guide tells a victim to follow its approved IRP. The plan should identify who can declare an incident, who has authority to isolate systems, who speaks for the organization, and who approves restoration or external notifications.
#1 Best Overall
If the plan exists only on a file share that is now inaccessible, retrieve the retained hard copy or offline copy. Keep a current offline version in your preparedness program; it is useful when identity systems, email, or document storage cannot be trusted.
Assign one incident commander
Designate one person to coordinate technical, business, legal, and communications decisions. Record the time the incident was declared, the people assigned, and every major decision. Separate technical observations from assumptions: “server cannot authenticate” is an observation; “the attacker is still present” is a hypothesis that requires evidence.
Set a decision log
Use a trusted, access-controlled log outside the affected environment. Capture the decision, decision-maker, time, available evidence, operational impact, and follow-up owner. This record helps responders avoid contradictory actions and gives counsel and investigators a reliable timeline.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Contain the attack without making evidence disappear
Isolate hosts and accounts first
Identify systems showing encryption, ransom notes, unusual authentication, endpoint alerts, disabled security tools, or suspicious administrator activity. Disconnect affected endpoints and servers from wired and wireless networks where doing so is safe and coordinated. Disable or quarantine accounts that show signs of compromise, but preserve the account and authentication records for investigation.
Use network-level isolation when spread is broad
If multiple systems or subnets are affected, host-by-host disconnection may be too slow. CISA recommends that taking the network offline at the switch level may be necessary. Coordinate switch-level isolation with the incident commander and the owners of life-safety, industrial, clinical, or other critical services; an indiscriminate change can create an outage beyond the ransomware damage.
| Situation | Containment action | Evidence concern |
|---|---|---|
| One or a few affected hosts | Disconnect those systems from network access and isolate related accounts | Keep the hosts available for memory capture and imaging when responders arrive |
| Several systems or subnets showing impact | Coordinate network or switch-level isolation | Record the exact switch, VLAN, firewall, and time changes |
| Systems supporting critical operations | Use the crisis team to sequence isolation around safety and continuity needs | Document who approved each interruption and what remained connected |
Do not treat shutdown as the default
CISA warns that powering down an affected device can destroy infection artifacts and evidence held in volatile memory. Disconnect network access first when possible. Power down only when other isolation methods are not possible or when a qualified responder directs it. If a device must be shut down for safety, record who made that decision, the time, and the method.
Protect backups and administration paths
Separate backup infrastructure, hypervisors, storage consoles, domain controllers, remote-access tools, and privileged accounts from the suspected compromise. Do not reconnect backup systems merely to test whether they work. Preserve offline, encrypted copies and the records that show when they were made and who could access them.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Repair Windows errors before they cause bigger problems3Scan for outdated or missing drivers - takes under a minuteMove coordination to out-of-band communications
An attacker may have access to corporate email, chat, shared calendars, file repositories, or conferencing systems. Use phone calls, prearranged emergency numbers, or another trusted channel that was not administered from the compromised environment. Verify participants independently before sharing incident details or credentials.
- Do not send the response plan, forensic images, passwords, or unredacted ransom notes through a potentially compromised mailbox.
- Use a call tree so the team can coordinate if identity services or mobile-device management are unavailable.
- Keep a contemporaneous record of calls and decisions in a clean, controlled location.
- Tell staff where legitimate updates will appear and warn them not to contact the attacker or post about the incident.
Preserve evidence before investigating aggressively
Capture volatile information when feasible
Memory may contain running processes, encryption keys, network connections, injected code, and attacker tooling that will be lost after shutdown. A qualified responder should decide how to capture memory safely and document the tool, operator, time, and hash or integrity information for each artifact.
Image systems and take cloud snapshots
When feasible, create forensic images of affected disks and capture snapshots of relevant cloud volumes. Preserve the original evidence, work from copies, and maintain chain-of-custody records. Include the system identifier, time zone, acquisition time, storage location, and people who handled the copy.
Rank #3
Collect logs from every layer
Preserve endpoint-detection records, authentication logs, firewall and VPN logs, cloud audit trails, email security events, DNS records, backup logs, and alerts from security appliances. Export them before retention periods or attacker actions erase them. Keep the original format where possible and record any filtering or conversion.
Record the ransom note and attacker indicators
Save ransom notes, contact addresses, wallet addresses, file extensions, sample encrypted files, filenames, timestamps, and screenshots. Do not open links or attachments in the note from a production device. Provide copies to investigators and counsel rather than editing the originals.
Triage what is affected and whether access continues
Build an impact inventory
Create a working list of affected endpoints, servers, virtual machines, cloud resources, user and service accounts, databases, backups, and business processes. Mark each item as confirmed affected, suspected, isolated, unavailable, or not yet assessed. Include dependencies: a payment application may rely on an identity service, database, DNS, and a third-party connection.
Look for the earlier compromise
Ransomware deployment is often the final visible step. Review endpoint, detection, identity, and network evidence for earlier credential theft, remote-access use, privilege escalation, persistence, and data staging. Search for signs of continued access after isolation, including new accounts, unusual administrator sessions, scheduled tasks, remote-management activity, and unexpected cloud tokens.
Assess data exposure separately from encryption
Determine whether files were copied or only encrypted. Examine outbound traffic, cloud-storage events, archive creation, unusual compression, and access to sensitive repositories. The answer affects legal analysis, notification planning, and the urgency of preserving evidence; do not assume that an encryption event proves or disproves exfiltration.
Bring in the right people before any negotiation decision
Internal stakeholders
- IT and security: containment, evidence handling, identity recovery, and restoration sequencing.
- Leadership: risk acceptance, business continuity, and resource decisions.
- Legal counsel: privilege, contractual duties, sanctions and legal restrictions, breach analysis, and communications review.
- Communications: employee, customer, partner, regulator, and media messaging.
- Business and safety owners: decisions about critical services and safe operation.
External responders
Notify the cyber insurer according to the policy and use any approved breach coach, forensic firm, managed security provider, or incident-response provider. Policies may require specific vendors, notification windows, or evidence-handling procedures. If internal capacity is limited, an established responder can coordinate imaging, malware analysis, threat hunting, and recovery while counsel manages legal questions.
Authorities and reporting channels
For U.S. incidents, CISA’s guide identifies CISA, the local FBI field office, FBI IC3, and local U.S. Secret Service field offices as reporting or assistance options. Reporting can support intelligence sharing and investigation even when the organization is still determining its losses. Outside the United States, contact the appropriate national cyber authority and law-enforcement channel. Notification duties and reporting processes vary by jurisdiction, sector, contract, and the data involved, so counsel should map the requirements to the specific incident.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Understand what the payment question does—and does not—mean
Payment is not guaranteed recovery
A decryption key may fail, be incomplete, or arrive with no help for damaged systems. An attacker may also retain or publish copied data. A payment can leave the organization exposed to additional extortion and does not remove the need to rebuild compromised systems and investigate the intrusion.
Federal guidance discourages ransom payment
In its BlackMatter advisory dated October 18, 2021, CISA states that “CISA, the FBI, and NSA strongly discourage paying a ransom to criminal actors.” The advisory explains that payment can embolden adversaries and does not guarantee recovery of files. Treat that as a policy and risk consideration, not as a substitute for incident-specific legal advice.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
If leadership is considering contact
Do not let an employee reply independently or transfer funds from a personal account. Counsel, the insurer, law enforcement, and qualified incident responders should evaluate recovery capability, safety and continuity needs, possible data exfiltration, legal restrictions, sanctions exposure, and the reliability of any claimed decryptor. Keep the decision and its evidence in the incident log. No outside party can promise that negotiation will restore data or prevent publication.
Best Value
Recover from clean sources, not from hope
Prioritize critical services
Rank systems by safety, essential operations, dependencies, and the consequences of prolonged outage. Restore the minimum services needed to operate, then expand in controlled stages. A system that is merely available is not necessarily clean.
Use offline encrypted backups
Restore from backups that were offline or otherwise protected from the compromise. Validate backup dates, integrity, and coverage before using them. Scan and examine restored systems in an isolated recovery network, rotate exposed credentials, and remove unauthorized persistence before reconnecting to production.
Reconnect only clean systems
Define acceptance checks for each system: verified image or rebuild, current security controls, patched software where feasible, new credentials, logging enabled, and monitoring in place. Reconnect in dependency order and watch for renewed encryption, unusual authentication, or outbound traffic.
Common first-response mistakes and safer alternatives
| Mistake | Why it causes harm | Safer alternative |
|---|---|---|
| Replying to the ransom note immediately | Reveals information, creates uncontrolled commitments, and may interfere with response work | Preserve the note and route every contact decision through the incident commander, counsel, insurer, and responders |
| Powering off every device | Destroys volatile memory and other artifacts | Isolate network access first; shut down only when necessary and documented |
| Continuing to use compromised email or chat | Lets an attacker monitor plans or impersonate staff | Use verified out-of-band communications |
| Restoring immediately from the newest backup | May reintroduce malware or use a backup the attacker altered | Validate offline encrypted backups and restore through an isolated, monitored process |
| Assuming encryption means there was no theft | Misses notification, legal, and safety consequences of exfiltration | Investigate access and outbound-transfer evidence separately |
| Letting multiple teams make unlogged changes | Creates conflicting containment and destroys timeline accuracy | Use one incident commander and a controlled decision log |
Prepare before the next incident
- Keep the IRP, contact tree, asset inventory, network diagrams, vendor details, and insurer instructions in hard-copy and offline forms.
- Pre-authorize emergency isolation actions and define who can approve switch-level changes.
- Maintain tested offline encrypted backups and document restoration dependencies.
- Arrange legal, forensic, managed-security, and communications contacts before an emergency.
- Test out-of-band communications and rehearse a scenario in which identity, email, and file systems are unavailable.
- Define evidence-handling, retention, and chain-of-custody procedures with qualified responders.
- Review notification plans and applicable law for the jurisdictions and sectors in which the organization operates.
The CISA guide was described as updated in September 2023 and was developed with CISA, MS-ISAC, NSA, and FBI operational input. Check the live guide for later revisions and current contact details before relying on a reporting procedure.
Quick Recap
Where to get authoritative guidance
- CISA #StopRansomware Guide: response checklist, planning guidance, and U.S. reporting contacts.
- CISA BlackMatter Ransomware advisory (October 18, 2021): federal guidance discouraging ransom payment and warning that recovery is not guaranteed.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
