The 30-Second Fix: Check If You're Actually Infected
First things first, make sure you're not staring at a fake warning. Some scummy sites pop up a full-screen alert that screams "YOUR FILES ARE ENCRYPTED" with a countdown timer. It's pure scareware. Had a client last month whose browser was just stuck on a malicious ad page, no files harmed.
Here's the quick test: hit Ctrl+Alt+Del and open Task Manager. If you see a browser process eating 90% CPU, that's your culprit. Close it and you're done. Also, try opening a file like a Word doc or a JPEG. If it opens fine, you're clear.
But if your files have weird extensions like .locked or .crypt, and you see a ransom note named DECRYPT_INSTRUCTIONS.txt in every folder, then yeah, it's the real deal. Proceed to the next step.
The 5-Minute Fix: Disconnect and Identify the Strain
The moment you confirm infection, yank the Ethernet cable or turn off Wi-Fi. This stops the ransomware from spreading to network drives. Don't shut down the PC though, you might lose the encryption keys that are still in memory.
Now, grab your smartphone and search for the ransom note text or the file extension. Something like *.locky* or *.dharma*. There are free decryption tools for many older strains. Check out the No More Ransom project (nomoreransom.org). They have a free tool that identifies the ransomware family and often provides a decrypter.
I remember a client who had .cerber files, and we used their tool to get everything back in an afternoon. If you find your strain on there, download the decrypter to a clean USB stick, plug it in, and run it. That's the whole job.
If you're not that lucky, check BleepingComputer's ransomware forum. Post your ransom note and file extension, they'll point you to a fix or tell you if it's hopeless.
The 15+ Minute Fix: Restore from Backup or Recover Files
No free decrypter? Then it's time for the real fix: restore from backup. If you have an external drive or cloud backup that wasn't connected when the attack hit, you're golden. Wipe the system, reinstall Windows, then restore your files.
For the reinstall, you'll want to boot from a clean USB. Use another PC to create a Windows 10 installation media. Then, after you're back up, install the backup software and pull your files. Make sure you scan everything with Malwarebytes before restoring, or you might re-infect.
No backup? Then you're in file recovery territory. It's a long shot, but sometimes the ransomware doesn't delete the original files—it just encrypts copies. Try TestDisk or Recuva to scan for deleted files in the shadow copies. Shadow copies are snapshots Windows makes for System Restore. Ransomware often deletes them, but sometimes they survive.
Here's a trick: right-click a folder, go to Properties, then the Previous Versions tab. If you see any versions, you can copy them out. I've had a few clients get their documents back this way.
If that fails, you can try a hex editor to carve out data from the raw disk. That's deep surgery and not for the faint-hearted. Not worth it unless it's irreplaceable family photos.
And here's the hard truth: if you don't have a backup, and the ransomware is a modern strain like REvil or Ryuk, there's no way to decrypt. Don't pay the ransom. A client paid $500 once and got nothing, the decrypter didn't work. The FBI and most experts agree: paying funds the criminals and you're not guaranteed to get your data back.
Wrap-Up: What to Do Post-Recovery
Once you're back up, run a full scan with Malwarebytes and update your antivirus. And for crying out loud, set up a backup. Use the built-in Windows File History or a cloud service like Backblaze. It's cheaper than paying the ransom.
Ransomware hits when you least expect it. Had a dental office get hit because someone opened a pdf that looked like a fax. Now they use a separate, offline backup drive that's only plugged in during backups. Smart move. You can do the same.