Symptoms
- Files renamed with strange extensions and won't open
- A ransom note file appears in folders demanding payment
- Desktop background changed to a threatening message
- Files spreading to network drives or other computers
Likely causes
- CommonRansomware from a malicious email attachment or downloadRansomware often arrives disguised as an invoice, document, or software crack.
- PossibleCompromised remote access softwareAttackers exploiting weak remote desktop passwords is a common entry point, especially on shared or work computers.
- Less commonInfected USB drive or network shareMalware can spread from an infected external drive or another computer on the same network.
What to do
- Disconnect the computer from Wi-Fi and unplug any ethernet or external drives immediately to stop it from spreading.
- Do not pay the ransom; payment does not guarantee file recovery and funds further attacks.
- Do not turn off the computer if you can help it, since some recovery tools need the current state, but do isolate it from the network.
- Photograph the ransom note and note any file extensions changed, for reporting and identification.
- Check if your files were backed up separately (cloud backup, external drive not connected at the time) so you can restore from there instead.
- Report the incident to the FBI's Internet Crime Complaint Center (IC3.gov) or your local equivalent.
- Have a professional assess whether a free decryption tool exists for that specific ransomware strain before wiping the drive.
When to call a pro
Ransomware recovery is best handled by a professional data recovery or cybersecurity service, especially if the computer is connected to a business network.
Safety
Use caution
Never pay a ransom demand or enter payment information into the ransomware screen; treat the infected computer as compromised and keep it off any shared network until cleaned.