Ransomware Locked Files? Fix It Now (No Ransom)

Deal with ransomware the practical way. Start with the 30-second check, then work through recovery and removal. Don't pay the ransom — most times you can get files back.

The 30-Second Fix: Check for Shadow Copies

Before you panic or start paying anyone, check if Windows still has shadow copies. This is the fastest way out and works surprisingly often. Ransomware doesn't always delete them, and when it doesn't, you're back in business in minutes.

Right-click a locked file, go to Properties, then the Previous Versions tab. If you see anything listed, select the latest version and hit Restore. That simple.

No luck there? Open a command prompt as admin and run:

vssadmin list shadows

If that returns a list, you're in good shape. To restore the whole folder, use:

copy "C:\Path\To\Shadow\Volume\*.*" "C:\Original\Path\" /y

Real talk: I've seen this save people who thought they'd lost everything. One client had a crypto locker hit their server, and shadow copies were still there because the ransomware variant didn't bother with the vssadmin delete shadows command. Took us five minutes to restore everything.

If the shadow copies are gone or the Previous Versions tab is empty, move to the next step.

The 5-Minute Fix: Kill the Process and Disconnect

If you caught the infection while it's still running — files are changing, weird processes in Task Manager — you need to stop the bleeding. Do this fast.

Open Task Manager with Ctrl+Shift+Esc.
Look for anything with random names, high CPU usage, or the file you just opened. Sort by CPU to spot it.
Right-click and End Task.
Pull the network cable or turn off Wi-Fi immediately. This stops the ransomware from talking to its command server.

Now check for persistence. Run regedit and look at:

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run

Anything suspicious, delete it. Also check HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run.

Next, run a malware scan. Use Malwarebytes — it catches stuff Windows Defender misses. Put it on a USB stick from a clean machine if you have to. Install, update, and do a full scan.

This won't get your files back, but it stops the damage from spreading. Skip this and you're just re-encrypting the same files after you restore them.

The 15+ Minute Fix: Restore from Backup or Decrypt

Now you're at the real recovery stage. If you have a backup — and I hope you do — this is where it pays off.

Option A: Restore from Backup

Clean the infected machine first. Nuke it. Reinstall Windows or restore from a system image. Then copy files from your backup. Make sure the backup is from before the infection date, or you'll be in a loop.

If you're restoring network shares, verify the backup is offline first. Some ransomware encrypts network drives too.

Option B: Try Decryption Tools

No backup? Don't pay the ransom. Honestly, paying doesn't guarantee you'll get your files back — about a third of victims never see a working decryption key, even after paying.

Check the No More Ransom project. They have free decryptors for dozens of ransomware families. What to do:

Identify the ransomware strain. Look for the extension added to your files — like .locky, .cerber, .dharma.
Go to the site and search for that name or extension.
Download the decryptor to a clean machine and run it on an encrypted copy first, not the original.

I've used this for GandCrab and Snatch. It works when the variant is known. For newer strains, you're out of luck unless someone reverse-engineers it.

Option C: The Last Resort — Check for Decryption Keys in RAM

If the ransomware was running recently and you haven't rebooted, there's a slim chance the master key is still in memory. Tools like FireEye's Memoryze can dump RAM, but honestly, this is advanced and rarely works unless you know what to look for. I'd skip it unless you're a forensic analyst.

What Not to Do

Don't pay. You're funding criminals and you might not get anything. There's a reason law enforcement says the same thing.
Don't reboot before checking shadow copies. Rebooting clears them if they're there.
Don't copy encrypted files over your backup. You'll overwrite the good data.

After You're Clean

Patch your systems. Update everything — Windows, Java, Adobe, the works. Ransomware commonly gets in through old vulnerabilities or phishing. Turn on controlled folder access in Windows Defender if you're on Windows 10 or 11. That alone can stop ransomware in its tracks.

Set up a proper backup system. Use the 3-2-1 rule: three copies, two different media, one offsite. Don't cheap out on this. I've seen too many small businesses lose everything because their only backup was plugged into the same server.

Final word: ransomware is a pain, but it's not automatically game over. Follow the steps in order, move fast, and you've got a real shot at getting your data back without paying a dime.