Free tools Windows power users keep installed
One-click scans. No signup required.
Contain the affected systems immediately, then investigate and recover under your organization’s incident response plan. Use network-level isolation where possible; if that is not immediately available, disconnect affected devices from Ethernet or Wi-Fi. Avoid powering them off unless disconnection is not possible or your responders direct it: shutdown can limit spread, but may erase evidence held in memory.
Contain affected systems first
Follow your organization’s incident response plan and coordinate the response with the people responsible for security and IT. CISA’s #StopRansomware Guide identifies immediate isolation of impacted systems as a containment priority. If multiple systems or subnets appear affected, the guide recommends taking the network offline at the switch level when feasible.
As an Amazon Associate I earn from qualifying purchases.
Choose an isolation method
| Method | When to use it | Important trade-off |
|---|---|---|
| Network- or switch-level isolation | When responders can isolate an affected network or subnet promptly. | Can contain multiple affected systems together; coordinate the change to avoid disrupting critical services unnecessarily. |
| Disconnect an individual device | When network-level isolation is not immediately possible. Unplug a wired device from Ethernet or remove a wireless device from Wi-Fi. | Contains that device’s network access, but may not address other affected systems. |
| Power down | Consider only when network shutdown or disconnecting affected hosts is not possible, weighing the containment need against evidence preservation. | May help limit spread, but can destroy volatile artifacts and evidence in memory. |
Where feasible, coordinate through out-of-band communications—channels not dependent on potentially affected systems. This can reduce the risk of alerting an attacker who may still have access.
Preserve evidence while containing the incident
Containment comes first, but powering off is not a neutral step. CISA warns that shutdown can prevent retention of volatile infection artifacts and evidence in memory. If your organization has the capability, preserve available system images, memory, and relevant logs. If it does not, involve qualified incident responders rather than improvising forensic collection on affected machines.
Investigate beyond the disabled protection tool
Do not assume that ransomware has stopped because endpoint protection is disabled, or that the visible encrypted devices are the only ones affected. CISA’s Play ransomware advisory describes malware used to disable endpoint protection, illustrating that attackers may deliberately target these controls.
Scope the compromise
- Review available antivirus and endpoint detection and response (EDR) alerts, intrusion detection system (IDS) data, and system and network logs for other affected devices or earlier activity.
- Investigate whether the ransomware deployment followed an earlier, unresolved intrusion. CISA notes that ransomware can be a later stage of a compromise.
- Record which systems are affected, what evidence remains available, and which services depend on them. Share findings through the coordinated response channel.
A disabled security tool is a reason to investigate with remaining telemetry and qualified support; it is not proof that an intruder has left the environment.
Rank #2
- THREAT DETECTION – Stay one step ahead. Suspicious links, risky sites, viruses, and scams, caught automatically before they reach you.
- PERSONAL INFO PROTECTION – Keep your personal info safer. Identity monitoring watches for your exposed info and tells you what to do about it.
- SECURE CONNECTIONS – Just a few easy clicks, and we'll automatically protect your info on public Wi‑Fi, every time you connect.
- GUIDED ACTION – Know what matters and what to do next. Clear alerts and simple guidance make it easy to take action.
- MORE THAN ANTIVIRUS – Scam protection, identity monitoring, VPN, web protection, and antivirus work together to protect you, all in one place.
Prioritize recovery in a clean environment
Identify critical services and their dependencies before restoring systems. CISA recommends restoring prioritized systems from offline, encrypted backups in a clean environment. Do not reconnect a device simply because its files have been restored: establish that the system and the environment used to recover it are not still compromised.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →- Map critical services and dependencies. Determine which systems must be restored first to support essential operations.
- Confirm the recovery source and environment. Use offline, encrypted backups and a clean recovery environment.
- Restore in priority order. Keep potentially compromised systems isolated; reconnect systems only when the organization’s response and recovery process supports doing so.
Bring in qualified help and check reporting duties
Engage qualified incident-response support if your organization lacks the expertise or tools to contain the incident, preserve evidence, or scope the compromise. CISA describes federal asset-response assistance and recommends consulting federal law enforcement about possible decryptors, even when mitigation appears possible. Which channel applies—and whether reporting is mandatory—depends on your organization and jurisdiction. Follow your incident response plan and consult the appropriate legal, regulatory, and law-enforcement contacts; this general guidance does not determine your reporting obligations.
Rank #3
- Mastering Microsoft Endpoint Manager: Deploy and manage Windows 10, Windows 11, and Windows 365 on both physical and cloud PCs
- ABIS BOOK
- Packt Publishing
What this guidance does not settle
The right containment and recovery decisions depend on the affected network, available response capability, critical services, and applicable jurisdiction. The cited CISA guidance does not establish a universal sequence for re-enabling a specific endpoint-security product. Do not treat reinstalling or turning protection back on as a substitute for containing the incident, investigating the compromise, and confirming the environment is clean.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
