Ransomware: Files Encrypted? What to Do First and What Never to Do

If your files suddenly will not open, have strange extensions or a note demands payment, treat it as ransomware. Disconnect the laptop from Wi-Fi and the network, unplug every external drive and USB stick, and photograph the ransom note. Do not pay, do not wipe the drive and do not plug in your backup drive until the laptop is clean. Then check whether you have a backup that was not connected, and get the machine cleaned before restoring anything.

Ransomware locks your files and asks for money to unlock them. The first hour matters, and most of the damage people regret comes from panic: paying, formatting, or plugging in the backup drive that was still healthy. This guide sets out what to do, in order, what to avoid, how recovery honestly works, and how to make the next attack harmless. We cannot promise that any particular set of files can be recovered, and nobody honest can.

How to recognise it

• Files that opened yesterday now show an error, or have a new extension added to their names.
• A text file, web page or wallpaper appears on the desktop or in folders, with a demand and a contact address.
• The laptop suddenly slows down, with the disk busy and many files changing at once.
• Shared folders and external drives show the same pattern.

A single file that will not open is usually a corrupt file, not ransomware. When whole folders are affected and a demand appears, it is ransomware.

What to do in the first few minutes

1. Disconnect from the network. Turn off Wi-Fi, unplug the network cable and disconnect any phone hotspot. This stops the attack from spreading to other computers and shared folders.
2. Unplug external drives and USB sticks. Do it before they are encrypted too.
3. Stop the damage if files are still changing. If you can see files being renamed, shutting the laptop down stops further encryption. Files already locked stay locked, but no more are lost.
4. Photograph the ransom note and a few affected file names. The wording and the new extension help identify the ransomware. Take the photo with your phone, not by saving on the laptop.
5. Leave other computers alone until you know whether they are affected. If it is an office, tell the others to disconnect as well.

What never to do

• Do not pay straight away. Paying does not guarantee a working key, it funds the attackers and it marks you as someone who pays. Many victims who paid were not able to open all their files.
• Do not format the drive or reinstall Windows yet. The encrypted files may become recoverable later if a decryption tool appears for that variant. Keep a copy of them, and the note.
• Do not plug in your backup drive. It may be encrypted as soon as it connects.
• Do not contact the attacker from your own email or name.
• Do not run "decryptor" downloads from unknown sites. Fake decryptors are a second scam.
• Do not delete the encrypted files to "clean up".

Check your backups

Whether you recover depends on backups more than anything else. Check these, from a clean device if you can:

• An external backup drive that was not connected at the time. It is probably safe. Connect it only to a clean computer.
• Cloud storage with version history. OneDrive, Google Drive and similar services keep earlier versions of files, and some let you restore a whole folder to a time before the attack. Check what your plan allows.
• Another computer or phone that holds copies of the same documents and photos.
• Email attachments hold more old documents than people expect.

Can the files be decrypted?

Sometimes, not always. For some ransomware families, security researchers have published free decryption tools. The No More Ransom project lists them and includes a tool that helps identify the ransomware from a sample file and the note. If your variant is listed, the tool may unlock your files. If it is not, the encrypted files cannot be opened without the attacker's key. Keep a copy of them, because tools for new variants appear over time. Our guide to data recovery cost explains why encrypted files are a different problem from a failing drive.

Secure everything else

1. From a clean device, change the passwords for email, banking, social media and cloud storage. Do your email first.
2. Turn on two-step verification where you can.
3. Warn your contacts if your email might have been used.
4. If money was demanded or taken, or you are in a business, report it. In India, the National Cyber Crime Reporting Portal at cybercrime.gov.in accepts complaints, and the 1930 helpline is for cyber financial fraud.

Cleaning the laptop

The ransomware itself must be removed before the laptop is used again, and files should come back only from a clean backup. In most cases the safe route is to copy off what can be saved, remove the infection or reinstall Windows, and then restore. Our ransomware removal and laptop virus removal pages explain what the work includes. Be sceptical about anyone who promises to get everything back before looking at the machine.

Make the next attack harmless

• Keep a backup that is disconnected. Copy important files to an external drive and unplug it afterwards, or use a cloud service with version history. A backup that is always connected can be encrypted with everything else.
• Keep Windows and your browser updated.
• Turn on Ransomware protection in Windows Security, which includes controlled folder access.
• Avoid cracked software and unknown attachments. They are the usual way in.
• Use a standard account for daily work and keep the administrator account for installing programs.

Our laptop data backup page covers setting up regular copies.

Getting help

If you are in the middle of an attack, tell us what you have done so far, switch the laptop off and bring it in or call. We collect within 2 hours of a booking by call or WhatsApp, and the inspection costs ₹350, credited if you go ahead. For the nearest branch, see computer repair near me.

Frequently asked questions

Should I pay the ransom?

Authorities advise against it. Paying does not guarantee your files back, and it encourages more attacks. Check backups and decryption tools first.

Can I use my laptop after ransomware?

Not until it has been cleaned or Windows has been reinstalled. Until then, treat it as infected and keep it offline.

Will antivirus remove ransomware and restore my files?

Antivirus may remove the program, but it cannot unlock files that are already encrypted. Restoring needs a backup or a decryption tool.

Can ransomware affect a MacBook or a phone?

Yes, though it is far more common on Windows computers. The same first steps apply: disconnect, do not pay and check your backups.