How to cure a computer from ransomware: step-by-step guide

If you need to cure a computer from ransomware, the main thing is not to panic and not to make hasty actions. Ransomware blocks access to files and demands a ransom for decryption. This article covers the first actions after infection, safe removal of the malware, checking data recovery options, preventing repeat attacks, and answers to frequently asked questions.

An important point: treating the computer and recovering files are different tasks. An antivirus can remove active malware code, but it does not always decrypt already damaged documents, photos, databases, or archives. Therefore, the order of actions is critically important.

What is ransomware

Ransomware is a malicious program that finds user files and encrypts them. After that, a ransom note appears on the screen or in folders. It usually specifies the amount, cryptocurrency wallet, payment deadline, and threats to delete the decryption key.

The following are most often encrypted:

• Microsoft Office and PDF documents;
• photos and videos;
• ZIP, RAR, 7z archives;
• databases and accounting files;
• projects, drawings, source code;
• files on connected network drives and external storage.

Ransomware can enter the computer through an email attachment, malicious link, pirated software, remote access vulnerability, infected flash drive, or compromised account. In a corporate network, one infected machine can sometimes become the entry point for an attack on servers and shared folders.

How to understand that the computer is infected with ransomware

Signs of infection are usually noticeable right away, but sometimes the attack develops gradually. The sooner you recognize the problem, the higher the chance to limit the damage.

Main symptoms

• Files stopped opening, although they worked before.
• Documents have strange extensions like .locked, .crypt, .encrypted, or a random set of characters.
• Folders have files with names like readme.txt, how_to_decrypt.html, restore_files.txt.
• The desktop has changed, and a ransom demand appears.
• The computer suddenly slows down, the disk is actively working, but you’ve launched nothing.
• The antivirus reports ransomware, Trojan, dropper, or a suspicious process.
• Shadow copies of Windows or restore points are unavailable.

What not to do

Erroneous actions can worsen the situation. Therefore, do not rush to reinstall Windows and do not delete everything indiscriminately.

It is not recommended to:

• pay the ransom without consulting a specialist;
• delete the ransom note if it contains the infection ID;
• format the disk before making a backup of encrypted data;
• connect backup drives to an infected computer;
• run suspicious