5 min read
Ransomware locks your files and demands payment for the key that unlocks them. The first hour after you notice the attack decides how much damage spreads and how much you can recover. Panic and quick clicks make things worse, so a calm, fixed order of steps matters more than speed alone.
This guide covers the first hour only: isolate, preserve evidence, find what is locked, and start recovery without paying. It is written for a home user or a small office with one or a few computers. Larger networks need an incident response team, but the same first steps still apply.
Disconnect the Machine Right Away
The moment you see a ransom note or files changing names, disconnect the machine from the network. Pull the Ethernet cable, turn off Wi-Fi, and unplug any shared drives. Ransomware spreads across a network, so one infected computer can lock files on other computers and on a shared drive.
Do not shut the computer down at once if you can avoid it. Disconnect first, then leave the machine on while you decide the next step.
Tell other people in the home or office to stop using shared folders at once. If the infected machine was connected to a network drive, unplug that drive too. A few minutes of isolation can save files on every other device in the building.
Do not pay the ransom in the first hour. Payment does not guarantee a working key, it marks you as a payer, and it funds the next attack. Recovery, backups, and free decryptor tools are better options, and they cost nothing to check first.
Take Photos and Save the Ransom Note
Use your phone to photograph the ransom note on screen, including any wallet address, deadline, and contact details. Take a photo of the file names if encrypted files show a new extension. These photos are evidence, and they help identify the ransomware strain later.
Save a copy of the ransom note file if one sits on the desktop or in a folder. Copy it to a USB drive that you do not use again on a clean machine. Do not open the note on another computer, since some notes carry links that lead to more malware.
Write down what happened and when: which file you opened, which site you visited, and when the first strange message appeared.
Keep the infected machine disconnected while you collect this evidence. Do not plug in a USB drive that holds your only backup, because the malware could lock that drive too. Evidence first, recovery second, and never on the same infected machine.
Find Out What Is Locked
Check which folders are affected without opening files. Look at Documents, Pictures, Desktop, and any shared drives for files with strange extensions or ransom notes. A quick folder listing tells you the scale of the damage better than opening each file one by one.
Check cloud folders carefully. If a sync folder on the infected machine holds encrypted files, the sync service may copy the locked versions to the cloud.
Look for backups that the malware cannot reach. Do not connect any backup drive to the infected machine to check it.
Identify the strain if you can. Free identification services accept a ransom note or one encrypted file and name the ransomware family. Knowing the strain tells you whether a free decryptor exists and whether recovery without payment is possible.
Start Recovery From a Clean Device
Do all recovery work from a clean device, never from the infected machine. Use another computer or a phone to contact your backup service, check cloud version history, and look up the ransomware strain. The infected machine stays disconnected until it is wiped.
If a clean backup exists, plan to wipe the infected machine and reinstall the operating system. Wiping removes the malware fully, while a simple antivirus scan can miss hidden parts.
Restore files only from backups that were made before the attack. Check the backup date against the time the attack started. A backup made after the attack began may already hold locked files, so test a few restored files before restoring everything.
Change passwords from the clean device, starting with email, cloud storage, and banking. The malware may have stolen saved passwords, so treat every password used on the infected machine as exposed. Turn on two-factor authentication wherever the service offers it.
Report the Attack and Harden the Machine
Report the attack to your local cybercrime reporting service. Give them the photos of the ransom note, the wallet address, and your timeline.
If the attack hit a work computer, tell your manager or IT contact at once, even if the damage looks small. A work network may need a full check, and hiding the incident can let the malware spread to colleagues and customers.
After the machine is wiped and rebuilt, harden it before you restore files. Install operating system updates, update the browser, and install a reputable antivirus program. Set up automatic backups that keep old versions, and keep one backup disconnected at all times.
Build habits that stop the next attack. Do not open unexpected attachments, do not enable macros in files from strangers, and keep software updated. A short pause before opening a strange file is the cheapest defense against ransomware.