Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Fix the driver behind crashes, sound loss and screen glitches3Clear out junk files and repair common Windows errorsContain the attack before trying to recover files. Isolate affected computers, servers, shares, cloud volumes and accounts; move coordination off potentially monitored email and chat; preserve evidence; report the incident; then restore only from verified, known-clean backups or rebuilt systems. Do not wipe machines, reconnect the network or pay a ransom before your incident lead, counsel, insurer and law enforcement have assessed the situation.
Ransomware can encrypt data and steal it at the same time. A sound response therefore has two tracks: stop further damage and determine whether confidential information left the business.
As an Amazon Associate I earn from qualifying purchases.
What to do in the first minutes
Activate the approved incident-response plan and appoint one incident lead. That person should maintain the timeline, assign technical and communications tasks, and approve major decisions. If you have no formal plan, designate a senior owner immediately and write down every action and time.
- Map the apparent impact. Identify affected endpoints, servers, virtual machines, file shares, cloud storage, backup systems, VPN accounts, remote-access tools and privileged identities. Note the encrypted-file extension, ransom note locations and the first reported time.
- Isolate affected systems. At the switch, host, Wi-Fi, VPN, remote-access and cloud-control layers, block communication from systems that may be compromised. Unplug Ethernet or remove Wi-Fi where practical. For broad impact, switch-level isolation is faster than visiting every workstation.
- Use an out-of-band channel. Coordinate by phone or another channel that attackers cannot monitor. Internal email and chat may be under attacker control, and discovery of your response can trigger faster lateral movement or data destruction.
- Do not destroy volatile evidence. If a host cannot be disconnected, power it down only as a last resort. Shutting down can erase memory and other evidence needed to identify persistence and the initial access route.
CISA’s September 2023 #StopRansomware guidance states: “Determine which systems were impacted, and immediately isolate them.” Treat that as the priority over trying to open files or negotiating with an attacker.
#1 Best Overall
- Read Before You Buy — No Video Output: These adapters support charging and USB 2.0 data transfer, but cannot transmit video signals. Except for standard USB webcams (which use USB data only), they are not compatible with HDMI/DisplayPort cables, video-capable USB-C hubs, or docking stations with video output.
- Convert USB-A Ports to USB-C: Designed to connect USB-C earphones, cables, flash drives, card readers, and other USB-C accessories to standard USB-A ports. Plug-and-play with no drivers or software required.
- Aluminum Alloy Housing: Built with a sturdy aluminum alloy shell that aids in heat dissipation and protects against daily wear and scratches. Designed to maintain a stable and secure connection.
- Compact & Travel-Friendly: The ultra-compact design allows the adapter to stay plugged into your device without blocking adjacent ports or adding bulk, reducing wear and tear on your original USB ports.
- 12-Month Warranty: Backed by a 12-month manufacturer warranty for peace of mind. Designed to meet strict quality control standards for reliable everyday performance.
How to contain the network without spreading the attack
Isolate broadly, then refine
Start with systems showing encryption, ransom notes, suspicious processes or unusual authentication. If the boundary is unclear, isolate the affected VLAN, server segment or site while keeping a clean recovery network available. Disable suspected VPN and remote-access paths, quarantine endpoints through your security platform, and block known attacker addresses only after preserving the relevant logs and configuration.
Protect backup and administration planes
Ransomware commonly searches for reachable backups and administrative credentials. Disconnect backup repositories from production where possible, suspend automated jobs that could overwrite clean copies, and restrict administrator access to a small, separately managed set of accounts. Do not log in to recovery consoles from a suspected workstation.
Keep a written action log
Record who isolated each asset, which switch port or account was changed, what evidence was collected and when. This log supports forensic reconstruction, insurance requirements, contractual notices and later improvements to the response plan.
Recommended Free Tools
Rank #2
- 5-in-1 USB-C Hub: Experience comprehensive connectivity featuring a Power Delivery input, two USB-A 2.0 ports, a USB-A 3.0 port, and an HDMI port. (Note: The USB-C power delivery input port is only for connecting an external wall charger to power your laptop and cannot power peripheral devices.)
- 90W Pass-Through Charging: Achieve optimal charging with 90W pass-through power to your laptop, supported by a total input of 100W, with the hub reserving 10W for operational efficiency. (Note: Wall charger not included.)
- Quick Data Transfers: Accelerate your productivity with rapid data transfers using a high-speed 5Gbps USB 3.0 port and two 480Mbps USB 2.0 ports.
- 4K HDMI Display: Enhance your visual experience with a hub capable of delivering 4K resolution at 30Hz in both mirror and extend modes. Please note that this hub is compatible with MacBook (macOS 12 and newer), Windows 10 and 11, ChromeOS, and laptops equipped with DP Alt Mode and Power Delivery. Note: This device is not compatible with Linux.
- What You Get: Anker USB-C Hub (5-in-1, 4K HDMI), welcome guide, 18-month warranty, and our friendly customer service.
Preserve evidence and investigate what happened
Collect evidence before reimaging or deleting anything. Preserve ransom notes, encrypted-file extensions, timestamps, user reports, disk or system images where feasible, memory captures, endpoint and firewall logs, authentication records, cloud audit logs and samples of suspicious binaries. Store copies in a protected location and calculate hashes if your responders use forensic tooling.
- Record attacker email addresses, URLs, cryptocurrency type and wallet address, ransom amount and payment instructions.
- Capture the earliest known compromise, unusual administrator activity, newly created accounts, remote-access sessions and changes to backup settings.
- Preserve a representative set of encrypted files without modifying them; their headers and extensions can help identify a known variant.
- Document every containment, credential reset, shutdown and restore action with UTC time and operator.
Do not assume that encryption is the only impact. CISA describes “double extortion,” where attackers exfiltrate data and threaten to publish it. Have responders examine outbound traffic, cloud-access logs, archive creation, unusual compression and large transfers. The absence of an obvious transfer does not prove that no data was stolen.
Who to notify and when
Follow the contact tree in your incident-response plan. Notify executives, the IT or security team, your managed security provider, cyber insurer, outside counsel and the communications lead. Insurers often require use of approved vendors or prior consent for response costs, so call the breach hotline before engaging a provider when your policy requires it.
Rank #3
- Sleek 7-in-1 USB-C Hub: Features an HDMI port, two USB-A 3.0 ports, and a USB-C data port, each providing 5Gbps transfer speeds. It also includes a USB-C PD input port for charging up to 100W and dual SD and TF card slots, all in a compact design.
- Flawless 4K@60Hz Video with HDMI: Delivers exceptional clarity and smoothness with its 4K@60Hz HDMI port, making it ideal for high-definition presentations and entertainment. (Note: Only the HDMI port supports video projection; the USB-C port is for data transfer only.)
- Double Up on Efficiency: The two USB-A 3.0 ports and a USB-C port support a fast 5Gbps data rate, significantly boosting your transfer speeds and improving productivity.
- Fast and Reliable 85W Charging: Offers high-capacity, speedy charging for laptops up to 85W, so you spend less time tethered to an outlet and more time being productive.
- What You Get: Anker USB-C Hub (7-in-1), welcome guide, 18-month warranty, and our friendly customer service.
For a U.S. incident, report to your local FBI field office and the Internet Crime Complaint Center (IC3). Consider assistance from CISA and the U.S. Secret Service. IC3 requests practical identifiers such as the ransomware variant if known, encrypted-file extension, cryptocurrency type and address, attacker email or URLs, ransom amount and whether payment occurred.
Free tools Windows power users keep installed
One-click scans. No signup required.
Do not announce a breach or promise a notification date based on a generic rule. Duties depend on jurisdiction, sector, the data involved, contracts and the people affected. Counsel should coordinate with the relevant regulator, customers, employees and law enforcement while preserving the investigation.
Should you pay the ransom?
The FBI’s ransomware guidance, updated August 18, 2026, says: “The FBI does not support paying a ransom in response to a ransomware attack.” CISA and the UK’s National Cyber Security Centre likewise discourage payment because it can fund criminal activity, encourage repeat attacks and still fail to produce a working decryptor or deletion of stolen data.
Rank #4
- Dual Converters, Infinite Potential：Includes 2× USB C male to USB A female adapters and 2× USB A male to USB C female adapters. Perfect for a wide range of uses—tablets with Bluetooth keyboards, expand USB ports on macbook, and more. Two different converters for all your daily needs
- Next-Level 10Gbps & 3A Charging: No more slow 480Mbps, this usb to usb c adapter has a transfer speed of up to 10Gbps, allowing you to do more transferring in less time. This usb adapter fits both USB A and USB C charger, supporting up to 3A fast charging
- Upgraded Exquisite Craftsmanship: With an aluminum alloy housing and metal connector, the usbc to usb adapter is extremely durable and sturdy. Rigorously tested to withstand more than 10,000 times of plugging and unplugging, ensuring long-lasting performance
- Broad Compatible: The usb c to usb adapter widely supports all USB C/ USB A devices like laptops, tablets, cellphones, car chargers, and phone chargers. Such as compatible with MacBook Pro/Air 2023/2022, Thunderbolt 4/3 Devices,Apple MagSafe Watch 9/8/7/SE/Ultra, iPad Pro 2022/2021, Samsung Galaxy S23/S20/S10, and iPhone 17/16/15 Pro. Plug and play
- Please Note: To reach 10Gbps speed, keep the cable under 3.3 ft. For USB A Male to USB C adapters, try flipping the USB C connector. USB C Male to USB A adapters support bidirectional 10Gbps transfer within 3.3 ft
Payment is not a recovery guarantee. Attackers may provide a defective key, demand more money, retain copied data or return later using credentials they left behind. A payment decision can also trigger sanctions concerns, insurance conditions, contractual duties and reporting obligations. If leadership is considering it under severe business-continuity pressure, obtain written advice from incident responders, counsel, the insurer and law enforcement, and conduct sanctions screening before any transfer. Do not let a negotiator bypass evidence collection or containment.
Choose a recovery path deliberately
Restoring from backups, rebuilding from golden images, hiring specialist responders and considering payment are different options, not interchangeable steps. Compare them against the factors that matter to your business:
| Approach | Containment speed | Evidence preservation | Recovery-point age | Restoration time | Reinfection risk | Exfiltration coverage | Typical decision use |
|---|---|---|---|---|---|---|---|
| Restore verified backups | High if systems remain isolated | Good when evidence is collected first | Depends on the last clean backup | Depends on data volume and dependencies | Low only after eradication and credential resets | Does not recover stolen data | Preferred when clean, tested copies exist |
| Rebuild from golden images | High after affected hosts are removed | Good if images are created after collection | Requires recreation of changes since the image | Often longer for bespoke applications | Lower when images and software are known clean | Does not recover stolen data | Use when hosts or backups cannot be trusted |
| Incident-response and digital-forensics firm | Can accelerate scoping and isolation | Strong when specialists collect evidence | Not applicable by itself | Varies by scope, staffing and environment | Reduced through validated eradication | Can investigate exfiltration | Useful when internal capability or staffing is limited |
| Payment after professional advice | Does not contain the intrusion | Can complicate investigation and legal review | Not assured | Not assured | May remain high if persistence is present | Deletion is not assured | Only a last-resort business decision, never an automatic recovery plan |
How to restore files without reinfecting the business
- Find the cleanest recovery point. Inventory every backup and snapshot, including cloud versions and removable media. Verify that the copy predates compromise and that attackers did not have write access to it. Check that backup catalogs, credentials and management servers are clean.
- Build a clean recovery network. Keep restoration systems segmented from suspected hosts and production. Use separate administration accounts and a trusted management workstation. Block unnecessary internet access while images and data are rebuilt.
- Rebuild priority infrastructure. Reimage or recreate identity services, DNS, network controls, storage and business-critical applications from known-clean golden images. Do not restore a complete system image merely because it is recent; a recent image may contain the attacker.
- Reset trust. Change privileged, service, VPN and remote-access passwords. Revoke stolen sessions, tokens, certificates and API keys. Review newly created accounts, delegation, scheduled tasks and persistence mechanisms before reconnecting services.
- Restore in business priority order. Bring back the services required for safety, revenue, customer support and legal obligations first. Restore data into clean hosts, validate permissions and test representative files before opening access to users.
- Monitor before production reconnection. Watch authentication, process creation, endpoint alerts, administrative changes and data egress. Investigate unusual beacons, failed logins, new persistence and unexpected transfers. Keep restored systems segmented until the response lead accepts the evidence.
- Document the result. Record what was restored, from which recovery point, which data could not be recovered and which systems remain under investigation. Update the incident, communications, backup and exercise plans.
Common recovery mistakes and safer alternatives
- Wiping immediately: destroys evidence. Capture required images, memory and logs first, or have a forensic specialist direct collection.
- Reconnecting everything at once: gives an attacker a route back in. Use staged restoration with segmentation and monitoring.
- Trusting every backup: ransomware may delete or encrypt accessible copies. Verify dates, integrity, access history and isolation before use.
- Using a generic file-recovery utility: consumer undelete tools do not decrypt an unknown ransomware strain and can alter evidence. Identify the strain and use specialist guidance.
- Resetting only user passwords: leaves service accounts, tokens, certificates and remote tools exposed. Rotate every credential and revoke active sessions that could have been stolen.
- Communicating through monitored systems: reveals your containment plan. Use an out-of-band channel until trust is re-established.
Build resilience after the incident
Design backups that ransomware cannot reach
Maintain offline, encrypted backups and test restoration regularly. A 3-2-1-style design is useful when implemented with independent credentials and at least one copy that attackers cannot alter from production. For cloud storage, evaluate immutability, versioning, delete protection or object lock, then verify the configuration and its cost implications. A disconnected, encrypted external drive can serve as one copy only when it is access-controlled, disconnected when not backing up and routinely tested.
Best Value
- 5-in-1 Connectivity: Equipped with a 4K HDMI port, a 5 Gbps USB-C data port, two 5 Gbps USB-A ports, and a USB C 100W PD-IN port. Note: The USB C 100W PD-IN port supports only charging and does not support data transfer devices such as headphones or speakers.
- Powerful Pass-Through Charging: Supports up to 85W pass-through charging so you can power up your laptop while you use the hub. Note: Pass-through charging requires a charger (not included). Note: To achieve full power for iPad, we recommend using a 45W wall charger.
- Transfer Files in Seconds: Move files to and from your laptop at speeds of up to 5 Gbps via the USB-C and USB-A data ports. Note: The USB C 5Gbps Data port does not support video output.
- HD Display: Connect to the HDMI port to stream or mirror content to an external monitor in resolutions of up to 4K@30Hz. Note: The USB-C ports do not support video output.
- What You Get: Anker 332 USB-C Hub (5-in-1), welcome guide, our worry-free 18-month warranty, and friendly customer service.
Reduce the attacker’s options
- Require multi-factor authentication, especially for administrators, email, VPN and remote-access tools.
- Apply least privilege and remove standing administrator rights where possible.
- Patch operating systems, applications, internet-facing services and security appliances promptly.
- Segment users, servers, backups and management systems so one compromised account cannot reach everything.
- Maintain an accurate asset inventory, endpoint protection, centralized logging and alerting.
- Keep tested golden images and documented rebuild procedures for critical services.
Exercise the human response
Run a scenario with leadership, IT, legal, the insurer, communications staff and critical vendors. Rehearse the first phone call, out-of-band coordination, evidence preservation, customer messaging, regulator analysis and staged restoration. An exercise should expose missing contacts and unclear authority before a real outage does.
What a complete incident record should contain
Maintain a single protected case file containing the timeline, affected assets, isolation actions, evidence locations, forensic findings, backup validation, restoration decisions, credential changes, notifications and unresolved risks. Include the business impact and any data that remains unavailable. This record supports law-enforcement reporting, insurance claims, legal analysis and a defensible lessons-learned review.
Ransomware recovery is complete only when systems are rebuilt or restored from trusted sources, attacker access has been removed, monitoring shows no persistence or reinfection, and the business understands whether data was exfiltrated. The final step is to turn those findings into funded changes to backups, access controls, patching, monitoring and the incident plan.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
