Ransomware locked my files: what to do in the first hour

This guide is for anyone who turned on the computer and found that the files will not open, and there is a message on the screen demanding payment. It is arranged in the order of what to do in the first hour, because what you do now determines how much can be saved.

What do you do in the first minutes?

Disconnect the computer from every network. Ransomware (software that encrypts files and demands payment to unlock them) can keep encrypting files on connected drives and on other computers on the same network.

1. Unplug the network cable, if there is one.
2. Turn off Wi-Fi. The simplest way: airplane mode, through the network icon in the corner of the screen.
3. Disconnect every external drive, USB stick and memory card that is plugged into the computer.
4. Do not shut down and restart over and over. The guidance from the US cybersecurity agency CISA recommends isolating the computer from the network, and powering it off only if it cannot be disconnected. Shutting down erases evidence that lives in memory.
5. Check the other computers in the house. If they have shared folders between them, disconnect them from the network too until you understand what happened.

How do you know it is really ransomware?

By the files, not by the message. Real ransomware changes the files themselves: usually an unfamiliar extension is added to them, they will not open, and a text file with payment instructions appears in every folder. Sometimes the desktop wallpaper is replaced with the message too.

A simple check: open File Explorer, go to the “Documents” or “Pictures” folder and try to open two old files. Do not try to change their extension back. That does not decrypt them.

If the files open normally, and the message appears only in the browser with a phone number or a request to “call support”, it is probably a scam page and not encryption. Close the browser through Task Manager (Ctrl+Shift+Esc) and read the guide about the “tech support” scam.

Why not plug in the backup drive now?

Because if the malware is still active, it will encrypt that too. A backup drive that was not connected during the attack may be the only clean copy you have left, and it is the most valuable thing you own right now.

You connect the backup only to a clean computer: a different computer, or this one after it has been reinstalled. Before you put the drive aside, make sure nobody in the house plugs it in “just to check”.

Should you pay the ransom?

The general advice is not to pay. That is also what the No More Ransom site says, a project whose partners include Europol and the Dutch police. The reasons, simply put:

• There is no guarantee you will get a key that works. You are paying a criminal who has no obligation to you.
• Paying confirms that the method works, and funds the next attack.
• You have no way of knowing what else is left on the computer. Even if the files open, the malware or its way in is still there.

Microsoft also writes on its page about protecting against ransomware that you should not pay, and that paying does not guarantee you will get the files back.

How do you document what happened?

Photograph and save, before you clean anything:

1. Photograph the message with your phone, not with a screenshot saved on the infected computer.
2. Write down the extension that was added to the files, and every email address, website or Bitcoin address that appears in the message.
3. Write down when you noticed, and what you did on the computer before that: a file you opened, an email, software you installed.
4. Do not delete the encrypted files. A decryption tool for them may be released in the future.

How do you check whether a free decryption tool exists?

On the No More Ransom site, from another computer. The site has a database of decryption tools for different ransomware families, and a tool called Crypto Sheriff that tries to identify which one attacked you.

1. From a clean computer or phone, go to nomoreransom.org. There is a Hebrew version too.
2. Choose Crypto Sheriff.
3. Upload two encrypted files, each up to 1MB. Copy them from the infected computer on a USB stick that has nothing else on it.
4. Add the ransomware’s instructions file, or type the email or Bitcoin address from the message. The site asks you to spell it exactly.
5. If a decryption tool exists, the site will point you to it with instructions. If not, keep the encrypted files and check again in the future.

Who do you report to in Israel?

The Israel National Cyber Directorate, by calling 119 or through the online reporting form on gov.il. The hotline is open around the clock, and it is meant for private individuals too, not only organizations. Reporting helps them spot attacks that are spreading, and sometimes they can point you to the next step.

How do you restore the files from a backup?

Only after the computer is clean, and only from a backup that was not connected during the attack.

1. Clean the computer or reinstall Windows. Reinstalling is the safest way to make sure nothing is left.
2. Connect the backup drive and manually check a few files: that they open and that they do not have the ransomware’s extension.
3. Restore the files, then change the passwords on your important accounts.
4. From here on, back up to a drive that is connected only while the backup runs. The guide how to back up your home computer explains how.

What do you do if OneDrive is full of encrypted files too?

If you have a Microsoft 365 subscription, you can take the whole OneDrive back to a point in time before the attack. According to Microsoft’s page on restoring OneDrive, you can undo all changes from the last 30 days.

1. From a clean computer, sign in at onedrive.com.
2. Click the gear icon, “Options” and then “Settings”.
3. Choose “Restore your OneDrive”, and pick a date and time from before the files were encrypted.

Without a subscription, you can try to restore file by file through its version history in OneDrive. In a large folder that is long work, but it is still better than paying.

How do you avoid this next time?

An offline backup is the most important protection, because it turns the attack from a disaster into an inconvenience. Beyond that:

• Windows updates installed, and Windows Security running.
• Controlled folder access in Windows Security blocks changes to protected folders by unknown programs. Microsoft recommends turning it on.
• Two-step verification on your email and your Microsoft account.
• Caution with email attachments, even when they look like an invoice or a delivery notice.
• Watch for early signs. The guide do I have a virus? real signs versus false alarms helps you spot malware before it reaches your files.

What if it is a business computer?

If the computer is connected to a business network, with a server, shared folders or several workstations, the whole network is handled by our sister company, A.M.S, IT services for businesses.

What not to do?

• Do not connect a backup drive, USB stick or phone to the infected computer.
• Do not pay and do not correspond with the attackers before you have checked the other options.
• Do not delete the encrypted files and do not format “to start fresh” before you have documented and copied samples.
• Do not download “decryption tools” from unfamiliar sites. Some of them are malware themselves. The trustworthy source is No More Ransom.

When to bring the computer to the lab

Immediately, if you have no clean backup, or if you are not sure what else was affected. Bring the computer disconnected, together with the backup drive, but without connecting them.

In virus removal we clean the malware and check how it got in. About the files, it is important to be honest: without a key or a decryption tool, in most cases encrypted files cannot be opened. A data recovery check can look for older copies left in other places on the disk. There is no guarantee that everything, or even part, will be recovered. We will do our best.

Did it not work out?

The goal of this guide is to get you through the first hour without losing more files, and to let you check for yourself whether a free solution exists. If you are stuck, ChipLab in Haifa handles virus removal and data recovery, and tells you what the odds are before starting.