Skip to content

Ransomware and malware infection

Ransomware encrypts files on infected computers and network drives, demanding payment for a decryption key. Other forms of malicious software can log keystrokes, steal stored passwords, or turn devices into remote botnets. Immediate isolation prevents the infection from spreading across your home or business network.

Do this now

  1. Disconnect the infected device immediately: Unplug Ethernet network cables and turn off Wi-Fi on the affected computer. Do not shut down or reboot unless instructed, as memory contents can contain forensic evidence.
  2. Unplug external storage drives: Disconnect any attached USB hard drives, flash drives, or external backup devices instantly to prevent files on them from being encrypted.
  3. Isolate other network devices: Disconnect other computers, smart TVs, and network attached storage (NAS) devices sharing the same Wi-Fi or wired network.
  4. Change passwords from an uninfected device: From a separate phone or secure computer, change passwords for online banking, primary email, and cloud storage services.
  5. Report the incident: File a report with the Cybersecurity and Infrastructure Security Agency (CISA) and the FBI at ic3.gov.

Evaluating recovery options

  • Avoid paying the ransom: Law enforcement agencies and cybersecurity experts advise against paying ransoms. Payment does not guarantee file decryption, funds criminal syndicates, and singles you out for future attacks.
  • Check for free decryptors: Visit the legitimate public repository nomoreransom.org, managed by Europol and cybersecurity firms, to check if a free decryption tool exists for your specific ransomware variant.
  • Restore from offline backups: If you maintain clean, offline backups created before the infection occurred, wipe the infected system drives completely and re-install your operating system before restoring files.

Clean system reinstallation

  1. Create a fresh operating system installation media USB drive on a known clean computer.
  2. Boot the infected computer from the installation USB drive.
  3. Format and repartition all internal storage drives to wipe all data and malicious code completely.
  4. Reinstall the operating system and install all current security patches.
  5. Install reputable anti-malware software before reconnecting to the internet.