Removing ransomware that encrypts files and demands Bitcoin

When this hits

You're working on a project, maybe editing a spreadsheet or opening an email attachment that looked legit. Suddenly, you can't open your documents. Photos turn into unreadable junk. You spot a text file named READ_ME_FOR_DECRYPT.txt or HOW_TO_DECRYPT.html sitting in each folder. The message says your files are encrypted and you need to pay 0.5 Bitcoin to some wallet address to get them back. Your heart sinks. The file extensions now look like .locked, .crypt, .encrypted, or .onion.

This isn't a failure of your antivirus—most ransomware variants are designed to bypass signature-based detection by encrypting files faster than scanners can react. The real trigger is usually a malicious macro in a Word document or a fake PDF download from a compromised website. Once executed, the ransomware reaches out to a command-and-control server, downloads a public key, and starts encrypting your files with AES or RSA. The Bitcoin demand is there because it's harder to trace than credit cards.

Root cause: why encryption happens so fast

Ransomware like STOP/DJVU, LockBit, or Phobos doesn't waste time. It maps your drives (C:, D:, external USB, network shares) and encrypts files with specific extensions—.doc, .xls, .jpg, .pdf, .mp4, .sql, .zip. It uses a combination of a unique per-file key and a public key from the server. That means even if you kill the process mid-encryption, some files might already be toast. The Bitcoin demand is just leverage—the attackers have no incentive to actually decrypt if you pay, since they can't verify your identity. Most victims who pay still lose their data.

The critical thing to understand: the malware itself is still running. It's not done until it either finishes encrypting every file or you stop it. Every second it runs, more files get locked. So speed matters.

Step-by-step fix

1. Disconnect from the network immediately. Pull the Ethernet cable, turn off Wi-Fi, and disable Bluetooth. You need to cut the connection to the C2 server. The ransomware might still encrypt locally, but it won't be able to send your decryption key to its server or download new instructions.
2. Shut down the computer by holding the power button for 10 seconds. Yes, this is a hard shutdown. It's safer than a normal shutdown because ransomware can hook into the shutdown process to encrypt more files. A cold boot stops it mid-stride.
3. Boot into Safe Mode with Networking. On Windows 10/11: turn on the PC, and as soon as the Windows logo appears, press and hold the power button again to force shut down. Do this three times. On the fourth boot, you'll see the Automatic Repair screen. Click Advanced Options > Troubleshoot > Advanced Options > Startup Settings > Restart > press 5 for Safe Mode with Networking. This loads Windows with only essential drivers and services—the ransomware won't start automatically.
4. Download a dedicated ransomware removal tool. The best option here is BleepingComputer's Ransomware Decryptors or Malwarebytes Anti-Ransomware. Don't rely on standard antivirus—it's too slow. Run a full scan with Malwarebytes in Safe Mode. The tool will detect and remove the ransomware executable, usually hidden in %AppData%, %LocalAppData%, or C:\Users\[username]\AppData\Roaming with a random name like sbsd32.exe or helpme.exe.
5. Check for a decryption tool. Go to No More Ransom and upload one of your encrypted files (don't pay—just upload the encrypted version). The site checks the file header and offers a free decryption tool if the variant is known. For STOP/DJVU, the tool works for offline keys generated before 2019. For newer variants, you might be out of luck.
6. Delete the ransom notes and reset file associations. Open File Explorer, search for READ_ME*, DECRYPT*, or HOW_TO* across your entire system (including Recycle Bin) and delete them all. Then run assoc .txt=txtfile and assoc .html=htmlfile in an admin Command Prompt to restore default file associations—ransomware often changes them.
7. Restore from backup. If you have a recent backup (external drive, cloud, or system restore point), now's the time. Use File History in Windows 10/11 or Previous Versions to recover files. If the backup was connected during the attack, it might also be encrypted—so check first. For cloud backups like OneDrive, you can restore from version history.

What to check if it still fails

If files remain encrypted: The ransomware variant might be a newer one with no decryption tool yet. Your best bet is to wait a few weeks—researchers often crack these. Don't pay; the decryption key might never arrive, and you're funding criminals. Keep the encrypted files on a USB drive in case a tool emerges later.

If the malware keeps coming back: You likely have a rootkit or boot-sector infection. Run a scan with Kaspersky TDSSKiller. If that doesn't fix it, you'll need to nuke the system: backup only non-executable files (documents, photos) to a clean external drive, then reinstall Windows from a USB installation media. This is the nuclear option, but it's the only way to guarantee the ransomware is gone for good.

If you can't boot into Safe Mode: The ransomware might have damaged the boot configuration. Create a Windows installation USB on another computer, boot from it, and select Repair your computer > Troubleshoot > Command Prompt. Run bootrec /fixmbr, bootrec /fixboot, and bootrec /rebuildbcd. Then try Safe Mode again.

One last thing: After the dust settles, disable macros in Office (File > Options > Trust Center > Trust Center Settings > Macro Settings > Disable all macros without notification). That single setting stops 80% of ransomware infections cold.