Ransomware Fix: Recover Encrypted Files (Don't Pay Bitcoin)

First, breathe. Then disconnect.

I know the panic that hits when you see that red screen demanding Bitcoin. It's gut-wrenching. But paying the ransom is the one thing you shouldn't do—statistically, only about half of victims get their files back even after paying, and you're funding the next attack. So let's skip the panic and get to work.

The immediate fix: quarantine and assess

**Step 1: Pull the network cable or turn off Wi-Fi.** This stops the ransomware from spreading to network drives and other machines. If it's a laptop, physically disconnect from any ethernet and disable Wi-Fi in the OS settings. Do not shut down normally—if it's actively encrypting, a forced shutdown mid-process might leave files partially encrypted but also might stop it. Hold the power button for 10 seconds if you must.

**Step 2: Boot into Safe Mode with Networking.** For Windows 10/11, restart and press F8 repeatedly (or Shift+Restart from the login screen). In Safe Mode, the ransomware won't auto-start, giving you a clean environment to work.

**Step 3: Identify the ransomware family.** This is critical. Look at the ransom note—it often has a name like LockBit, REvil, or Phobos. If the note is generic, check the file extensions added to your encrypted files (e.g., .lockbit, .eking). Then go to No More Ransom—it's a legit project by Europol and cybersecurity companies. Search their decryptor database by the ransomware name. If you find a match, download the tool and run it. That's the dream fix: free, instant decryption.

If you don't find a decryptor, move to the next step.

Restore from backup (the real fix)

Here's the truth: the most reliable fix is wiping the system and restoring from a clean backup that wasn't connected when the infection hit. If you have a recent backup on an external drive that's been disconnected, you're golden. Here's the order:

Disconnect the backup device physically. Don't just unplug it from the network—remove the USB cable. Some ransomware variants wait for new drives to appear and encrypt them too.
Wipe the infected drive. On a separate clean PC, use a tool like DBAN or the built-in Windows reset (but disconnect all other drives first). A full format is safer than a quick format.
Reinstall Windows or your OS. Keep the machine offline until you've updated it and installed antivirus.
Plug in the backup and restore. Scan it first with updated antivirus to be sure it's clean.
Change all your passwords—email, banking, cloud accounts—from a different, clean device. Ransomware often steals credentials too.

Why this works (and what doesn't)

The reason quarantine and restore work is that ransomware is a one-way street for encryption—it uses strong AES encryption with the key held on the attacker's server. There's no backdoor in the math. So unless a decryptor exists (because the gang got shut down or made a mistake), you can't decrypt without the key. That's why prevention beats any cure, and why I'm so hard on backups. The only alternative—paying—is a gamble where you might get nothing, and even if you do, the malware stays on your system unless you clean it anyway.

Some folks try free 'ransomware decryption' tools from random sites. Skip those—most are scams that infect you further. Stick to No More Ransom or your antivirus vendor's official tool.

Less common variations

Not every ransomware hits the same way. Here are a few curves I've seen:

Partial encryption. Some newer variants only encrypt the first few kilobytes of a file to look like full encryption. Tools like PhotoRec (for images) or Disk Drill can sometimes recover the untouched parts. It's a long shot, but worth trying on a copy of the drive.
File renames without encryption. Some scareware just renames files and shows a fake ransom note. Check if the file content is actually readable—if you can open a .txt or .jpg, it's a bluff. Simply change the extension back.
Ransomware on network drives only. If your PC is clean but a server got hit, disconnect the server immediately, then follow the same restore steps from the server's backup.
Master boot record (MBR) lockers. These don't encrypt files but lock the boot screen. Boot from a live Linux USB, back up your data files manually, then rebuild the MBR with bootrec /fixmbr from a Windows recovery environment.

Prevention: do this before the next attack

You don't want to be in this spot again. Here's my non-negotiable list:

Enable the 3-2-1 backup rule. Three copies of your data, on two different media types, with one copy offsite (cloud or a drive at a friend's house). Automate backups—don't rely on memory.
Turn on controlled folder access in Windows Defender (under Ransomware protection). It blocks unauthorized apps from modifying your documents, and it catches ransomware before it encrypts.
Patch your software. The most common entry points are unpatched browsers, PDF readers, and Remote Desktop Protocol (RDP). If you don't need RDP, disable it. If you do, use a strong password and two-factor auth.
Block macros in Office. Ransomware loves email attachments with macros. Set Word/Excel to disable macros by default.
Use a standard (non-admin) user account for daily work. Most ransomware needs admin rights to encrypt everything; a standard account limits the blast radius.

That's the full picture. You've got this—recover your data, then harden your setup so the next attempt bounces off. If you have a specific variant name, drop it in the comments and I'll point you to the right decryptor or recovery path.