Kill Ransomware Mid-Encryption: Stop It Before Your Files Are Gone

You're Watching Files Get Renamed. Here's What to Do Right Now.

I've seen it a hundred times. A user calls, panicked — folders full of .locked, .crypt, or some random extension. The clock is ticking. Don't freeze. Do this.

Step 1: Kill the Ransomware Process Immediately

First thing — disconnect the network cable or turn off Wi-Fi. You want to cut off communication with the C2 server. Then open Task Manager (Ctrl+Shift+Esc). Look for anything suspicious: high CPU, weird process names like encrypt.exe, vssadmin.exe (legit but used by ransomware), or svchost.exe running from a temp folder. Right-click and End Task.

If Task Manager won't open (ransomware often blocks it), use taskkill from an admin command prompt. Press Win+R, type cmd, hit Ctrl+Shift+Enter to run as admin. Then run:

tasklist | findstr /i "encrypt"
taskkill /F /IM encrypt.exe

Replace encrypt.exe with whatever you find. Don't bother with Process Explorer — Task Manager or command line is faster when every second counts.

Step 2: Stop the Encryption in Its Tracks

The culprit here is almost always a scheduled task or a persistent service. Open Services (services.msc) and look for anything with a name like Windows Update Service that isn't Microsoft's. Disable it. Then run taskschd.msc and check Task Scheduler Library — delete any task that runs from AppData or Temp folders with weird names.

Step 3: Don't Pay. Restore From Backup.

Here's the hard truth: decryptors rarely work unless you have a specific variant like REvil or LockBit and the FBI releases a key. Paying funds crime and may not get your files back. If you have a backup — external drive (disconnected after backup), cloud backup with versioning, or a NAS that was offline — restore from that. If you don't, you're left with data recovery attempts, which are hit-or-miss.

Why This Worked

Ransomware works by encrypting files in place, then deleting Volume Shadow Copies via vssadmin.exe Delete Shadows /All /Quiet. By killing the process early, you stop it from encrypting more files. Disconnecting the network prevents it from contacting its command server for a ransom key or spreading laterally. Stopping the scheduled task blocks it from restarting after reboot.

Less Common Variations

1. Ransomware That Modifies the MBR

Some variants like Petya overwrite the Master Boot Record. You'll see a skull and crossbones or a ransom note before Windows loads. Fix: Boot from a Windows recovery USB, run bootrec /fixmbr and bootrec /rebuildbcd. Then restore files from backup. Don't boot into the infected drive — it'll re-encrypt.

2. Ransomware That Uses PowerShell or WMI

Modern strains like Ryuk run entirely in memory via PowerShell scripts. You won't see a process in Task Manager. Fix: Check PowerShell event logs (Get-WinEvent -FilterHashtable @{LogName='Microsoft-Windows-PowerShell/Operational'; ID=4104}). If you see base64-encoded strings, kill all PowerShell processes: taskkill /F /IM powershell.exe. Then disable PowerShell execution via Group Policy.

3. Ransomware That Encrypts Network Shares

This is the nasty one — it encrypts mapped drives and even NAS shares. Fix: Immediately disable SMB on the infected machine (sc stop lanmanserver). Then check your NAS — if it has versioning or snapshots, roll back. If not, you'll need to rebuild from backup.

Prevention — The Only Real Defense

You can't patch stupid, but you can patch software. Here's what actually works:

• Keep backups offline. External drive that's only connected during backup, then disconnected. Cloud backup with immutable versioning. Test a restore once a quarter.
• Block macros in Office. 90% of ransomware starts with a phishing email containing a malicious macro. Set Group Policy to disable macros from the internet.
• Disable SMBv1. It's still on by default in some Windows 10 builds. Disable-WindowsOptionalFeature -Online -FeatureName smb1protocol
• Use AppLocker or WDAC. Only allow executables from Program Files and Windows directories. Ransomware often runs from AppData.
• Patch aggressively. EternalBlue (MS17-010) is still exploited in 2024. Unpatched systems are a free invite.

If you've already been hit — don't beat yourself up. It happens. But learn from it. Set up that backup today. You won't get a second chance.