What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Disconnect suspected infected devices from wired, wireless, and mobile networks, then involve the right responders. Don’t reflexively shut down or wipe a device: containment is not the same as deleting files, and powering off can destroy evidence needed to understand and recover from an attack. The safest next steps depend on whether this is one personal device or a wider organizational incident.
What should you do first?
- Isolate affected devices from networks. Unplug Ethernet, turn off Wi-Fi, and disconnect other wired or mobile network links. If several systems may be affected, an organization’s response lead should coordinate isolation, including at the network level where appropriate. An attacker may move between systems if they realize the incident has been detected. CISA’s #StopRansomware Guide advises organizations to identify impacted systems and isolate them immediately.
- Contact the people responsible for response. At home, use a separate, trusted device to seek reputable technical support. At work, activate the incident-response plan and contact IT or security leadership. If organizational email, messaging, or phones may be compromised, use an out-of-band channel such as a personal phone call.
- Keep potential evidence intact. Don’t delete ransom notes, suspicious files, logs, or messages, and don’t install an unverified “decryptor.” Record what happened and what actions were taken, using a device or record store that is not suspected of compromise.
Should you turn off the infected computer?
Not automatically. When feasible, disconnecting a device from the network is generally preferable to powering it off: shutdown can erase volatile-memory evidence and other infection artifacts. CISA says to power down only when network disconnection is not possible. If malicious activity is continuing or you cannot isolate the device, the response team must weigh containment against preserving evidence; UK NCSC guidance on highly disruptive attacks treats disconnecting or shutting down as a decision for the response team, not a universal rule.
As an Amazon Associate I earn from qualifying purchases.
For a home user who cannot get expert help immediately, disconnect the device’s network connections and leave it alone rather than experimenting with cleanup. If you are unsure how to isolate it safely, get help from a reputable technician using a separate trusted device.
Free tools Windows power users keep installed
One-click scans. No signup required.
What should you preserve and record?
Keep the ransom note and suspicious messages or files, and do not clear logs or attempt improvised repairs. In an organizational incident, short-lived evidence may include system memory, Windows Security logs, and firewall log buffers; qualified responders can advise what to capture and how. Preserve evidence without delaying necessary containment.
#1 Best Overall
- Slim durable design to help take your important files with you
- Vast capacities up to 6TB[1] to store your photos, videos, music, important documents and more
- Back up smarter with included device management software[2] with defense against ransomware
- Help secure your important files with password protection and hardware encryption
- 3-year limited warranty
Maintain a timeline of the suspected start, systems affected, observed symptoms, decisions, actions, and information that could not be captured. The Counter Ransomware Initiative’s organizational guidance recommends careful incident records for later review, lessons learned, or regulatory evidence. Keep the record off systems that may be compromised.
Who should you contact and how do you report it?
Organizations: activate the incident-response and communications plans. Involve internal IT and security leadership, relevant organizational stakeholders, the cyber insurer, and response providers as applicable. If an insurer may cover response costs, check policy requirements before engaging a provider. For a complex incident, qualified incident responders can help scope the compromise, collect evidence, contain attackers, and plan recovery.
Rank #2
- Slim durable design to help take your important files with you
- Back up smarter with included device management software[2] with defense against ransomware
- Help secure your important files with password protection and hardware encryption
- 3-year limited warranty
In the United States: CISA identifies CISA, a local FBI field office, FBI IC3, and U.S. Secret Service offices as reporting or assistance routes. The FBI’s ransomware guidance explains its reporting options. In the UK, use the reporting channels identified by UK NCSC ransomware guidance. Elsewhere, contact your national cyber authority and local law enforcement. Reporting does not replace containment or incident response.
Should you pay the ransom?
Do not assume payment will restore files, end the compromise, or make stolen data disappear. The FBI states that it does not support paying ransom; CISA and UK NCSC also warn that payment does not guarantee recovery. Even if a key decrypts files, that does not establish that attackers have been removed or that they deleted copied data. Payment can also encourage further attacks. The Counter Ransomware Initiative advises assessing what data may have been compromised, verifying claims about stolen data, and considering potential harms and legal requirements.
Rank #3
- No wall warts: Work freely with its bus-powered USB-C. No wall outlet required.
- Big on space: High-capacity storage to store all your files in one place.
- Reliable backup: Safeguard assignments, projects, or sensitive files with trusted performance.
- Fuss-free, clutter-free: One port, one cord, quick connect.
- Peace-of-mind: Comes with two-year limited warranty and Rescue Data Recovery Services.
For an organization, any payment decision belongs with leadership and appropriate technical, legal, insurance, and law-enforcement advisers. The FBI’s position and reporting information are set out in its ransomware guidance.
How should recovery differ by situation?
| Situation | Immediate priority | Who to involve | Recovery focus |
|---|---|---|---|
| One personal device | Disconnect its network access; do not attach backup media. | Reputable technical support, contacted from a separate trusted device. | Protect detached backups and get advice before attempting cleanup or file recovery. |
| Small business | Isolate affected devices and protect backup systems. | IT provider, insurer, and the person responsible for incident response. | Do not restore a device onto a network that may still contain an attacker. |
| Multiple systems or larger organization | Coordinate isolation, communications, evidence preservation, and service priorities. | Incident leadership and specialized response support where available. | Investigate the compromise and plan recovery before reconnecting systems when possible. |
For home users, UK NCSC’s home-user and small-business guidance was published in 2017 and addresses the WannaCry scenario; its containment and detached-backup points are useful here only as general principles consistent with broader current guidance.
Rank #4
- High-capacity external hard drive with up to 2TB of storage The ModusTech Facet portable external hard drive gives you dependable HDD storage in a slim 2.5-inch design. Multiple capacities available up to 2TB — back up photos, videos, music, documents, and game libraries with room to grow. A trusted external storage solution for everyday backup, media archives, and creative work.
- USB-C and USB 3.1 connectivity with included 2-in-1 cable The Facet ships with a USB-C to USB-C cable and tethered USB-A adapter, so this external hard drive connects to modern laptops, USB-C iPhones, tablets, and older USB-A computers without buying an extra cable. USB 3.1 Gen 1 (5Gbps) interface delivers real-world transfer speeds up to 100MB/s — fast enough to back up 50GB of files in about 8 minutes.
- Plug-and-play external hard drive for PC, Mac, and laptops Preformatted in exFAT and ready to use the moment you plug it in. The Facet works out of the box with Windows PCs, macOS Macs, MacBooks, Chromebooks, and laptops — no drivers, no software, no setup required. A true plug-and-play external hard drive built for everyday use across every major operating system.
- External hard drive for PS4, Xbox One, and Smart TV gaming The Facet is compatible with PlayStation 4, Xbox One, and Smart TVs with USB support. PS4 and Xbox One games run directly from the drive — plug it in, format through the console, and add to your storage. Also works with Smart TVs that support USB recording or external media playback.
- Slim, shock-resistant portable external hard drive — 160g At 2.5 inches and just 160g, this portable external hard drive is bus-powered through a single USB-C cable — no separate power adapter, no extra cables. Slim enough for a laptop bag, jacket pocket, or camera bag, with a shockresistant casing and faceted diamond-texture top panel that resists fingerprints and everyday wear. Backed by a 1-year limited warranty from ModusTech, a consumer electronics brand specializing in external storage.
How do you restore files and devices safely?
- Understand the scope. Identify affected devices and accounts, including email, administrator, remote-access, identity, and cloud accounts. Work out how attackers got in and whether they may have left a way back in.
- Secure accounts in a coordinated way. Plan credential changes with responders so you do not lock them out of accounts needed for containment or recovery. Address exposed credentials and attacker persistence before reconnecting systems.
- Use a known-clean recovery source. Keep backups disconnected except when needed, and verify that the backup and destination are free of malware. CISA recommends offline, encrypted backups; UK NCSC says to restore only when confident that both the backup and receiving device are clean. Prioritize critical services according to organizational needs.
- Rebuild and reconnect cautiously. Rebuild or wipe infected devices as appropriate, install current software in a clean environment, and monitor systems after reconnection. A device is not secure merely because its files have been restored.
Before choosing a recovery path, responders should consider whether it preserves useful evidence and contains the attacker, whether the restore point and destination are known clean, how the choice affects critical services and people, and whether the original compromise and exposed credentials have been addressed. The right balance depends on the incident; official guidance does not prescribe one recovery sequence for every device or organization.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallQuick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
