Quick answer
If your files are encrypted, immediately disconnect the computer from the network and the internet, do not pay the ransom, and do not delete anything. Preserve evidence (ransom note, encrypted files), check backups, and run a scan from another, clean computer. If multiple devices or servers are affected, stop work and contact IT support.
How to recognize the problem
- Files have unusual extensions (e.g. .locked, .enc, .crypt) and cannot be opened
- A text file with ransom payment instructions appears on the desktop or in folders
- The screen background is changed to a warning message
- The computer is slow, and antivirus reports a threat or has been disabled
- Network drives and shared folders are also affected
Most common causes
Phishing email with a malicious attachment
The most common infection route is opening an attachment (ZIP, document with macros) or clicking a link in a fake message. Ransomware runs when the user allows execution.
Software or system vulnerability
An outdated operating system, browser, or application can be exploited to automatically download and run ransomware. Regular updates reduce this risk.
Weak passwords and RDP access
Attackers often guess passwords for remote access (RDP) or network shared folders. Once inside, they spread encryption to other devices.
Unprotected removable media
USB drives and external disks can transfer ransomware from an infected computer. Connecting such media to a clean computer can restart the infection.
Step-by-step fix
- 1
Disconnect the computer from the network and internet
Immediately unplug the network cable and turn off Wi-Fi (in Windows 11:
Settings > Network & internet > Wi-Fiturn off the switch; in Windows 10:Settings > Network & Internet > Wi-Fi). This prevents spreading to shared folders and other computers. Do not turn off the computer if you are unsure whether encryption has finished, as evidence may be lost. - 2
Do not pay the ransom and do not delete files
Paying does not guarantee data recovery and encourages attackers. Save the ransom note (text file, background) and do not attempt to decrypt files yourself unless you have a verified tool. Delete only if an IT expert tells you it is safe.
- 3
Preserve evidence and note the time
Take a photo of the screen with the ransom message and write down when you noticed the problem. Copy a few encrypted files and the text file with instructions to a separate USB drive that you will immediately disconnect and later not connect to other computers without scanning. This data helps identify the ransomware type and possible recovery.
- 4
Check if you have a backup
If you have an external disk or network backup, do not connect it to the infected computer. Check the backup from another, clean computer. If the backup was connected at the time of infection, it may also be encrypted, so treat it as potentially infected.
- 5
Run a scan from another computer
If you know how, use a verified antivirus from a bootable USB. Do not connect the removed hard disk directly to a clean computer without write protection. Run a full scan, but do not open encrypted files. If you are unsure how, skip this step and consult an expert.
- 6
Change passwords from a clean device
From another clean computer or phone, change passwords for email, banking, and other important accounts. Enable two-factor authentication where possible. Do not use the infected computer to log in to accounts.
- 7
Notify the authorities and stay calm
If this is a business environment, notify the IT department and management. In Serbia, you can report to the Ministry of Internal Affairs and the National CERT (CERT.RS). Do not share details of the attack publicly until the situation stabilizes.
If nothing helps: recovery and expert assistance
If you have no backup and files are permanently encrypted, do not try to "fix" them with improvised tools. There are public databases (e.g. ID Ransomware) where you can submit a sample of an encrypted file and the ransom note to identify the ransomware type. For some older types, free decryption tools are published by antivirus vendors, but for new versions they rarely exist. If multiple computers or servers are affected, disconnect the entire network from the internet and call IT support. After recovery, be sure to perform a clean installation of the system (before that, save only verified data, as installation wipes the disk), change all passwords, and establish regular backups according to the 3-2-1 rule (three copies, two media, one off-site).
How to prevent it
- Make regular backups and keep them separate from the computer (disconnected external disk or cloud with versioning)
- Update Windows to a supported version, macOS, browser, and applications as soon as updates are available
- Do not open attachments and links from unexpected messages, even if they seem familiar
- Enable two-factor authentication and use strong, unique passwords
When to call a professional
If multiple devices, a server, or an entire business network is infected, or if you do not have a verified backup, call IT support before attempting to solve the problem yourself. An expert can isolate the infection, assess the damage, and safely recover data.
IT infrastructure maintenance · Servers, networks, backup, security and helpdeskFAQ
Should I pay the ransom to get my files back?
Not recommended. Paying does not guarantee you will receive working files and may mark you as a target for future attacks. Instead, preserve evidence and check backups.
Can I decrypt the files myself?
In rare cases, for known older ransomware types, free tools exist. For most new infections, there is no public solution. First identify the ransomware type (e.g. via ID Ransomware) and do not pay in advance.
What if ransomware affected a network drive?
Immediately disconnect the network drive or stop sharing from the infected computer. If possible, disconnect the server from the network as well, but do not turn it off without expert advice. Contact an IT expert because the risk of spreading to other users is high.