Immediate steps
- Disconnect from the network immediately — pull the ethernet cable or disable Wi-Fi. Ransomware often spreads laterally across networks.
- Do not shut down the PC yet — some encryption processes can be interrupted.
- Photograph the ransom note screen for reference.
Identify the ransomware strain
Upload an encrypted file and the ransom note to id-ransomware.malwarehunterteam.com. It identifies the strain and links to any available free decryptors.
Free decryptors
Check nomoreransom.org — a joint law enforcement / security firm project with 100+ free decryptors. Many strains including older LockBit, Djvu, and Stop ransomware variants have free tools.
Restore from backup
The only fully reliable recovery. Wipe the machine, reinstall Windows, and restore from a clean backup predating infection.
Shadow Copy check
Some ransomware families do not delete Volume Shadow Copies. Run vssadmin list shadows — if copies exist, ShadowExplorer can restore files.