Ransomware: what to do in the first hour

If your files have strange new names, will not open, and a note demands payment in cryptocurrency, assume ransomware. Do the first two steps now, before reading further. The rest can be done calmly from another device, such as your phone or a family member’s computer.

1. Disconnect from the internet and unplug drives

   Ransomware can spread to other computers on your network and to any drive it can reach, including your backup.

   • Unplug the network cable if there is one. Then select the network icon at the bottom right of the screen and switch on Airplane mode.
   • Unplug USB sticks, memory cards and external drives. Keep any backup drive well away from this PC.
   • If there are other computers at home, check them for the same signs.

   Do not restart the PC yet. If you can see files still being renamed, hold the power button until it turns off, because stopping further damage comes first.

2. Photograph the ransom note and record the details

   You will need these details to identify the ransomware and to report it. With your phone, photograph:

   • the whole ransom note, including any name the criminals use, and any email address, website or payment address;
   • a File Explorer window showing a few affected files, so the new ending added to their names is visible;
   • any deadline or countdown.

   Do not delete the note or the encrypted files, even though they are useless for now. If a free decryptor appears later, it will need them.

3. Do not pay or contact the criminals

   Paying is the decision people most often regret. You may never receive a working key, payment marks you as someone who pays, and it funds the next attack. The FBI and the UK’s National Cyber Security Centre both advise against paying.

   Do not reply to the email address in the note, even to ask a question.

4. Check No More Ransom for a free decryptor

   No More Ransom was set up by Europol, the Dutch police and security companies. It identifies the ransomware and links to free decryption tools where they exist. Use another device for this step.

   1. Type nomoreransom.org into a browser and open Crypto Sheriff.
   2. Upload two encrypted files, and either the ransom note file or the email address, website or payment address it gives.
   3. Read the result. If a decryptor exists, get it only through the link on No More Ransom and follow its instructions exactly.

   To move two encrypted files to the other device, copy two small ones onto a USB stick and unplug it as soon as the copy finishes. If no tool exists yet, keep your encrypted files; decryptors are sometimes released months later.

5. Report the attack

   A report creates a record for your bank or insurer, and it helps police track the groups behind these attacks. Have your photographs ready.

   • United States: the FBI’s Internet Crime Complaint Center at ic3.gov.
   • United Kingdom: Report Fraud, which replaced Action Fraud in December 2025, at reportfraud.police.uk. It covers England, Wales and Northern Ireland; in Scotland, report to Police Scotland.
   • Elsewhere: your national police or cyber security agency.

   If the PC held banking details or saved passwords, also phone your bank using the number on your card.

6. Reset Windows before restoring anything

   Restoring files onto an infected PC can get them encrypted again. Someone had control of this PC, so the safest course is a fresh copy of Windows.

   1. On Windows 11, open Settings › System › Recovery. On Windows 10, open Settings › Update & Security › Recovery.
   2. Under Reset this PC, start the reset, then choose Remove everything and Cloud download.

   If you cannot sign in, reach the recovery screen as described in the Safe Mode procedure and choose Troubleshoot › Reset this PC. A Defender scan can remove the ransomware program, but it cannot unlock files that are already encrypted.

7. Restore your files and close the gaps

   Once Windows is fresh and fully updated, bring your files back.

   • From a backup drive: connect it only now, check that the files on it open normally, then copy them back.
   • From OneDrive: the encrypted versions will have synced too, but earlier versions are kept. Sign in at onedrive.com, right-click a file and choose Version history to restore an earlier copy. With a Microsoft 365 subscription you can roll back your whole OneDrive to a point in the last 30 days using Restore your OneDrive.

   Then change your important passwords, starting with email, because many ransomware groups copy data before encrypting it. In Windows Security, consider turning on Controlled folder access under Virus & threat protection › Manage ransomware protection; it may block some apps from saving until you allow them. Keep at least one backup on a drive you unplug after each use.