What to Do if You Get a Ransomware Warning or Encrypted Files
Seeing a ransomware message or can't access your files? Here's what to do immediately, how to potentially recover your data, and when paying the ransom makes sense.
What's Happening
Ransomware encrypts your files with a key that exists only on the attacker's server, then leaves a note demanding payment for that key. Modern strains use real cryptography (AES or RSA), so there is no "unlock trick" — the math genuinely cannot be reversed without the key. What determines whether you recover your data is not cleverness, it's whether an unaffected copy exists somewhere the malware could not reach, or whether researchers have already cracked that specific strain. Many variants also try to delete Windows shadow copies and encrypt mapped network drives and attached backups, which is why your first few actions matter more than anything you do later.
Immediate Steps: What to Do Right Now
- Disconnect from the network — unplug ethernet and turn off Wi-Fi. This stops the malware from reaching network shares and other PCs while encryption is still in progress.
- Do not shut down or reboot — some strains finish encryption or wipe recovery data on restart, and decryption keys occasionally remain in memory.
- Disconnect external and backup drives — any USB or external drive still attached is a target.
- Photograph the ransom note and a few encrypted filenames with your phone — the note text and the new file extension are how the strain gets identified.
- Power off other devices on the same network until the infected machine is isolated.
First, Identify The Strain — It Decides Everything Else
Before you try anything, determine which ransomware family hit you, because that single fact dictates whether recovery is even possible. Upload the ransom note and one encrypted file to ID Ransomware (id-ransomware.malwarehunterteam.com). The result splits your situation into one of three outcomes: (1) a known, broken strain — a free decryptor exists and your data is recoverable without backups; (2) a known, unbroken strain — only a clean backup will save you, decryptors are not coming soon; (3) unidentified — treat it as unbroken and rely entirely on backups. Skipping this step is how people waste days on dead-end fixes or pay a ransom when a free tool already existed.
Recovery Options
Option 1: Restore From Backups
If you have backups, this is the cleanest path — but order matters.
- Do not connect backup media to the infected machine yet.
- Remove the infection first (see below) or wipe and reinstall Windows.
- Only then restore, and verify the backup files weren't encrypted before you trust them.
Important: backups that were connected or mapped during the attack may also be encrypted. Cloud storage with version history (OneDrive, Google Drive, Dropbox) can sometimes roll individual files back to a pre-attack version.
Option 2: Free Decryption Tools
If ID Ransomware flagged a broken strain, go to No More Ransom (nomoreransom.org) and use Crypto Sheriff to find the matching decryptor. Also check Emsisoft, Kaspersky, and Avast decryptor pages. Follow the tool's instructions exactly — running the wrong decryptor can corrupt files further.
Option 3: Windows Previous Versions
If shadow copies survived (many strains delete them, but not all), right-click an encrypted file > Properties > Previous Versions. Restore the most recent pre-infection version. Worth trying for critical documents even if it only works for some.
Removing The Ransomware
Recover files only after the infection is gone:
- Boot into Safe Mode: Settings > System > Recovery > Advanced startup > Restart now, then Troubleshoot > Advanced options > Startup Settings > Restart, then press 4.
- Run anti-malware scans: download Malwarebytes on a clean PC, transfer via USB, run a full scan in Safe Mode, then run Windows Defender Offline.
- Check startup persistence: Ctrl+Shift+Esc > Startup tab, disable anything unrecognized; rescan in normal mode.
Should You Pay The Ransom?
Why paying is a bad bet: a significant share of victims who pay never receive a working key, payment funds and encourages the operation, and it marks you as a paying target. The only scenarios where it's even discussed: the data is irreplaceable, no backups exist, no free decryptor exists, and the strain has a documented track record of delivering keys. Even then, involve a cybersecurity professional before sending anything — they can verify the strain's reputation and handle the transaction to maximize the (still uncertain) odds.
Prevention For The Future
- Keep offline backups using the 3-2-1 rule: 3 copies, 2 media types, 1 offline/offsite. A backup that is always plugged in is not a ransomware backup.
- Patch Windows and software — many attacks exploit known, already-fixed vulnerabilities.
- Enable Controlled Folder Access: Windows Security > Virus & threat protection > Manage ransomware protection.
- Be wary of email attachments and links — macro-enabled Office files and unexpected archives are common delivery methods.
- Use a standard (non-admin) account for daily browsing and email.
Where DIY Stops — And Why
Some ransomware situations cannot be resolved by a homeowner regardless of how carefully you follow steps:
- An unbroken strain with no clean backup. The encryption is mathematically sound. There is no DIY recovery — only forensic salvage of whatever shadow copies, cloud versions, or unencrypted fragments may remain, which requires specialist tools.
- The infection keeps returning. That means a persistence mechanism or a second payload (often a credential stealer) is still active. Until it's fully removed, every recovery attempt re-exposes your data.
- Business or irreplaceable data with payment on the table. Strain verification, secure handling, and incident documentation for insurance or legal purposes are not DIY tasks — a wrong move here can destroy the only recovery path you have.
- You need to know how it got in. Without forensic analysis, you'll likely be reinfected through the same hole.
This is where professional PC repair and recovery matters — the goal is to preserve every recovery option before a well-intentioned step closes one off, and to make sure the machine is genuinely clean before you trust it with restored data.
Need Expert Help?
Ransomware attacks require immediate professional attention. Geeks in Sneaks can help assess your situation, attempt data recovery, safely remove the infection, and implement robust backup and security solutions to protect against future attacks. Time is critical—schedule an emergency visit today.
Related Topics
Need Professional Help?
If you're still having trouble, our expert technicians can help.
Learn about our pc repair serviceMore Windows Problems Fixes
See all Windows Problems fixes →Should I Worry About Windows Event Errors?
Found errors and warnings in Event Viewer and worried something is wrong? Here's the truth about Windows event logs and what you actually need to fix.
How Long Should a Windows PC Last?
Wondering if your PC is getting too old? Here's the realistic lifespan of Windows computers and when it's time to upgrade versus repair.
Why Does My Cursor Freeze Momentarily?
Mouse cursor stuttering or freezing for a second or two randomly? Here's what causes it and how to fix the annoying micro-freezes.
Is It Normal for Disk to Be Slow After Boot?
Computer sluggish for the first few minutes after starting up? Learn why this happens, when it's normal, and how to speed up your post-boot experience.
Is 80°C CPU Temperature Dangerous?
Worried about your CPU hitting 80°C? Here's the truth about CPU temperatures, what's safe, and when you actually need to be concerned.
Why Does My Fan Spin Up Randomly?
Computer fan suddenly revving up for no apparent reason? Here's why it happens, when it's normal, and when you should be concerned.
Why Is Windows Search Using So Much Disk?
Windows Search Indexer maxing out your disk usage at 100%? Here's why it happens and how to fix it without losing search functionality.
Is High RAM Usage a Problem in Windows?
Seeing 70% or 80% RAM usage in Task Manager? Before you panic, read this to understand when high RAM usage is normal and when it's actually a problem.