Isolate affected systems first, then preserve evidence, report the incident, protect clean backups, and recover only in an environment your response team considers safe. Do not reflexively shut down every computer, wipe drives, restore backups into the compromised network, or assume that paying will recover your files. The sequence below follows U.S. organizational guidance from CISA, the FBI, IC3 and NIST. Home users and people outside the United States should adapt the reporting and legal steps to their local authorities and obtain qualified technical advice.
What to do in the first minutes
Ransomware may be discovered as inaccessible files, a ransom message, unusual system behavior, or a combination of these signs. A visible payment screen is not required. Treat the event as an active security incident until responders establish what happened.
As an Amazon Associate I earn from qualifying purchases.
“Determine which systems were impacted, and immediately isolate them.”
Recommended Free Tools
Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.
- Activate the incident-response plan. Name the incident lead, bring in IT and security staff, and follow the organization’s communications plan instead of improvising separate actions.
- Identify affected hosts and accounts. Record which computers, servers, cloud services, network segments, user accounts and email systems show symptoms or may have been accessed.
- Isolate the affected systems. Disconnect Ethernet or Wi-Fi when that is the feasible containment measure. If several systems or subnets are involved, take the relevant network offline at the switch level rather than unplugging endpoints one by one.
- Use an out-of-band communications channel. Attackers may monitor corporate email or collaboration tools. CISA advises using methods such as phone calls when appropriate so response coordination is not exposed through the compromised environment.
- Do not power systems off unless necessary. Network disconnection is preferred when possible because shutdown can destroy volatile-memory evidence. Power down only when a host or network cannot otherwise be disconnected safely.
Containment takes priority over convenience, but it should be coordinated. A well-meaning employee who reconnects a machine, shares a compromised administrator account, or starts an unsupervised restore can spread the incident or destroy evidence.
Should you turn off a computer infected with ransomware?
Usually, no—not as the first move. Disconnect the device from wired and wireless networks while leaving it running if responders can safely do so. Memory may contain running malware, encryption keys, command history or other volatile artifacts that disappear at shutdown. CISA treats powering down as a fallback when network isolation cannot be achieved.
If the computer cannot be disconnected from the network, is actively threatening other systems, or presents a physical safety risk, responders may decide that a shutdown is necessary. Document who made that decision, when it happened and what connections were removed. Do not reboot repeatedly, run cleanup utilities, delete files, or reformat the drive before qualified responders decide what evidence is needed.
Notify leadership, specialists and authorities
Use the organization’s escalation list to notify security and IT leadership, relevant management, the cyber-insurance contact, technology providers, communications staff and legal counsel as appropriate. The incident may involve privacy, contractual, regulatory, safety or continuity obligations; those duties depend on the facts and the jurisdiction, so obtain advice rather than assuming one notification rule applies everywhere.
Free tools Windows power users keep installed
One-click scans. No signup required.
For a U.S. incident, CISA’s guide recommends reporting to or seeking assistance from CISA, a local FBI field office, the FBI Internet Crime Complaint Center (IC3), or a local U.S. Secret Service field office. The FBI’s victim guidance directs victims to a local field office or IC3:
- CISA #StopRansomware Guide for containment and response guidance.
- FBI Ransomware for victim assistance and payment guidance.
- FBI Internet Crime Complaint Center (IC3) Ransomware page to submit an online complaint.
Reporting does not guarantee a direct response, decryption or reimbursement. Outside the United States, contact the police, national cyber-incident authority, data-protection regulator or other body that has jurisdiction, and follow your insurer’s and counsel’s notice requirements.
Rank #2
Preserve the ransom note and incident evidence
Save copies of ransom notes, messages, chat transcripts and screenshots in a location that is not controlled by the compromised network. Do not click links in a note merely to test them. Keep the original files and record when and where each item was found.
IC3 identifies the following details as useful complaint information:
- The suspected ransomware variant or name.
- Encrypted file extensions and examples of affected file paths.
- Attacker email addresses, usernames, websites and URLs.
- Cryptocurrency wallet addresses, payment instructions and transaction identifiers.
- The ransom amount, deadline, negotiation history and any payment already made.
- A timeline showing discovery, isolation, shutdowns, account changes and other response actions.
Where feasible, qualified incident responders should preserve relevant logs, system images and memory captures. Useful sources can include endpoint, authentication, firewall, cloud and backup-service logs. Collection should be performed in a way that maintains evidence integrity and respects legal or insurer requirements. Containment remains the priority; avoid unnecessary actions that overwrite or destroy data needed to determine the entry point and scope.
Protect backups before attempting recovery
Backups are a recovery resource only when they are clean and protected from the compromised environment. Secure backup servers, appliances, cloud consoles and removable media immediately. Disconnect backup systems from affected networks when possible, and restrict administrative access while responders determine whether backup credentials or management interfaces were exposed.
Before restoring anything, establish which backup sets predate the intrusion and have not been altered or encrypted. A backup that completed successfully can still contain the attacker’s files, scripts or persistence. The FBI’s organizational guidance and CISA both advise restoring prioritized services from clean backups in a clean network segment, not directly into the infected production environment.
Rank #3
NIST recommends that organizations plan, implement and test backup and restoration strategies and keep backups isolated from ransomware. Its guidance, “NIST Releases Tips and Tactics for Dealing With Ransomware” (published May 13, 2021; page updated February 3, 2025), is useful for turning the immediate response into a tested continuity process.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Investigate accounts and contain stolen credentials
Ransomware may be the final stage of an intrusion in which attackers stole passwords, tokens or session cookies. Scope the investigation beyond encrypted files: review domain and local administrator accounts, email accounts, remote-access tools, cloud identities, service accounts and backup administrators.
The FBI’s organizational guidance says to change online and network passwords after systems are taken off the network. Coordinate resets with the incident lead and responders. Resetting credentials on a still-compromised host can hand new passwords to the attacker, while resetting only one account can leave another route open. Revoke active sessions and tokens where the relevant service supports it, and require stronger authentication after the response team confirms that the identity environment is under control.
Should you pay the ransom?
Payment is not a guaranteed recovery method. The FBI states: “The FBI does not support paying a ransom in response to a ransomware attack.” Its victim guidance warns that payment does not guarantee that data will be recovered. A payment can also create technical, operational, legal and business consequences, including continued extortion, unreliable decryption, sanctions concerns and funds that support further criminal activity.
Do not present payment as a routine technical fix or make the decision in isolation. Escalate to executive leadership, legal counsel, the insurer, qualified incident responders and law enforcement. They can assess whether any proposed transaction is lawful, whether the attacker is linked to a sanctioned entity, what evidence must be preserved and what alternatives exist. Keep records of all contact and negotiation even when the organization decides not to pay.
Recover in a clean environment
Recovery should be staged according to safety and operational importance rather than whichever system is easiest to restore. The response team should rebuild or restore on a clean network segment, validate the operating systems and applications, and check restored data before reconnecting services.
- Define priorities. Identify services whose loss affects safety, essential operations, customers or legal obligations.
- Prepare the clean environment. Rebuild systems from trusted installation media or known-good images, apply security updates, and harden administrative access before loading restored data.
- Restore selected data and services. Use backup sets that responders have assessed as clean. Scan and validate files, databases, applications and permissions.
- Test before reconnecting. Confirm authentication, logging, endpoint protection, network controls and business functions in the isolated segment.
- Reconnect gradually. Return systems to production only when the response team considers them clean, and monitor for renewed encryption, persistence or unusual outbound traffic.
Do not reconnect a compromised host simply because its files have been decrypted, and do not assume that a working backup proves the original entry point has been closed. Continue monitoring accounts, endpoints, network traffic and backup administration during the return to service.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.What individuals should do with a personal device
The detailed CISA checklist is written mainly for organizations, not as a substitute for individualized forensic or legal advice. A home user should still disconnect the infected computer from Wi-Fi and Ethernet, avoid connecting USB drives or other removable media, and stop using shared network storage until the situation is assessed.
Do not wipe the device immediately if you may need evidence for an insurance claim, police report or professional recovery attempt. Photograph or save the ransom message without following untrusted links, note the affected file extensions and keep any attacker contact details. Use another known-clean device to contact a qualified technician or the appropriate local authority. If the device belongs to an employer, school or other organization, report it through that organization’s incident process instead of attempting a personal repair.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →People outside the United States should use their national cybercrime reporting channel and local legal or data-protection advice. The U.S. reporting links above can provide background, but they do not replace the authority that has jurisdiction over your incident.
Best Value
Choosing outside incident-response help
If internal capability is limited, engaging a qualified incident-response or digital-forensics provider can help with containment, evidence collection, scoping and recovery. Treat that escalation as an addition to immediate isolation and reporting, not a reason to wait.
Evaluate providers against the incident’s actual needs:
- Demonstrated ransomware incident-response and forensic experience.
- Ability to collect and preserve evidence defensibly.
- Coverage in the countries or jurisdictions involved.
- Availability, on-call capacity and expected response time.
- Compatibility with the organization’s cyber insurer, outside counsel and reporting obligations.
- Clear handling of confidential data, credentials and recovered systems.
Ask who will make technical decisions, who owns collected evidence, how communications will be secured and what information the provider needs before arrival. A provider should not discourage reporting or promise guaranteed decryption.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Fix the driver behind crashes, sound loss and screen glitches3Clear out junk files and repair common Windows errorsAfter services are stable
Keep a detailed incident record from discovery through restoration: decisions, timestamps, affected assets, evidence locations, notifications, credential changes, backup tests and validation results. Conduct a structured review after operations return, identify the initial access and control failures where possible, and update the response plan.
Use the lessons to test restoration rather than merely documenting it. Verify that backups can be recovered, that backup administration is separated from ordinary user accounts, that network isolation can be performed quickly, and that staff know how to reach the response team through an out-of-band channel. NIST’s backup and restoration advice is designed for this preparation as well as for post-incident improvement.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
