A pop-up you cannot close. Files that have turned into gibberish with a note demanding payment. A browser that keeps opening pages you did not ask for. What you do in the first hour matters more than anything a technician does afterwards, because it decides whether the problem stays on one machine or spreads to your backups, your email and the rest of the office.
Minute one: disconnect
Pull the network cable or turn Wi-Fi off. On a laptop, flight mode works. Ransomware spends its first minutes looking for other machines, shared drives and cloud folders to encrypt, and many infections phone home for instructions. Cutting the connection stops both. Do not shut the computer down yet unless files are visibly being encrypted in front of you; if they are, hold the power button.
Minutes two to five: stop it spreading
- Unplug any USB drives or external hard drives. If a backup drive was connected, it may already be affected. Do not plug it into anything else.
- If the machine syncs to OneDrive, Google Drive or Dropbox, sign in from your phone and pause syncing. Those services keep old versions of files, which is often how we get everything back.
- In an office, tell everyone to stay off shared folders until it is checked.
Minutes five to twenty: protect your accounts
Using your phone or another clean device, change the passwords for your email first (it is the key to everything else), then banking, then anything with saved card details. Turn on two-factor authentication wherever it is offered. If a password manager was open on the infected machine, change its master password too.
Do not pay, and do not run random “fixes”
Paying a ransom funds the next attack and only sometimes gets files back. Downloading a “free virus remover” from a search result is how a lot of second infections start. Leave the machine off the network and get it looked at.
What recovery looks like
- We boot the machine from clean media, identify the infection and remove it without trusting the installed Windows.
- Files are recovered from the best available source: cloud version history, a disconnected backup, shadow copies or, for some older ransomware families, a published decryption key.
- Windows is either cleaned or rebuilt, depending on what was touched. For ransomware we almost always rebuild.
- The way in gets closed: an unpatched program, a weak remote-desktop password, an email attachment. Then backups are set up so next time is an inconvenience, not a disaster.
The thing that makes the difference
A backup that is not permanently plugged in. An external drive that lives in the drawer and is connected once a week, or a cloud backup with version history, turns ransomware from a catastrophe into an afternoon. If you do not have one, that is the first thing to sort after the clean-up. We set them up as part of every security job, and for businesses it is built into ongoing IT support.
Need a hand? Infected right now? Disconnect it, then ring. We can usually start remotely within the hour and will tell you whether it needs to come in. Send an enquiry or ring 0423 870 531 and we will tell you straight away whether it is a two-minute fix.