Files locked and a ransom note on screen: first steps

Some scary messages only pretend to be ransomware. Before anything else, take a moment to see which kind you have.

• Real ransomware: your own photos and documents will not open, their names have a strange new ending added (for example a run of random letters), and a note about payment sits in your folders or on the desktop.
• A fake warning: the message sits inside your web browser, you can still open your files normally, and it may claim the police have locked your computer or show a phone number.

If it is a fake warning, your files are fine. Follow our guide to closing a fake virus warning safely instead.

Cutting the connection stops the ransomware reaching other devices, shared folders and online storage such as OneDrive. It also stops it talking to the criminals behind it.

1. Select the network icon at the bottom-right of the screen and turn off Wi-Fi. If a cable runs from the computer to your router, unplug it.
2. Unplug any USB sticks, external hard drives and memory cards.
3. Do not plug your backup drive back in until the computer has been wiped clean, later in this guide.

If other computers in your home share files with this one, check that their files still open normally.

Paying is very tempting when precious photos are at stake. But police and governments advise against paying, for good reasons:

• There is no guarantee the criminals will unlock your files, even after you pay.
• People who pay are often asked for more, or targeted again later.
• Payments in cryptocurrency or gift cards cannot be reversed.

Do not reply to any email address in the note, and do not visit any website it gives. There are other, safer ways forward.

A clear record helps identify which ransomware you have, which matters for the next step. It also makes your report easier.

• Use your phone to take clear photos of the ransom note, and of a folder showing some of the locked file names.
• Write down the date and time you noticed, and what you were doing just before. For example, opening an email attachment or installing a program.
• Note any name the ransomware gives itself, and any email or web address in the note.

No More Ransom (another website) is a free project run by police agencies, including Europol, together with security companies. It offers free tools, called decryptors, that unlock files scrambled by many kinds of ransomware.

1. On your phone or another computer, open the Crypto Sheriff page on No More Ransom (another website).
2. Enter the details it asks for. This can include the email or web address from the ransom note, and two of your locked files if you can copy them on a spare memory stick that holds nothing else.
3. If a free tool exists, the site links to it. Read its instructions fully before using it.

If no tool exists yet, keep your locked files. New tools are added over time.

Reporting helps police link attacks together, and you may need a report reference for your bank or insurer.

• In the US, report it to the FBI's Internet Crime Complaint Center at ic3.gov (another website).
• In the UK, use Report Fraud (another website).
• Elsewhere, contact your national police.

Some ransomware also copies personal files. If you kept bank details or ID documents on the computer, tell your bank. In the US, IdentityTheft.gov (another website) explains how to protect yourself. Change your important passwords from a different device, starting with email.

Scans can remove ransomware, but the surest way to know the computer is clean is to reinstall Windows. This is called Reset this PC.

1. Select Start, then Settings, and go to SystemRecovery. On Windows 10, go to Update & SecurityRecovery.
2. Next to Reset this PC, select Reset PC (on Windows 10, Get started).
3. Choose Remove everything. When asked how to reinstall Windows, Local reinstall works without the internet.
4. Follow the prompts. It can take an hour or more.

Once Windows is fresh, sign in, reconnect to the internet and run Windows Update. Then bring your files back.

• OneDrive: if you pay for Microsoft 365, sign in at onedrive.com, select the Settings gear, then OptionsRestore your OneDrive. It can roll your files back to how they were up to 30 days ago. Without a subscription, you can recover single files through each file's Version history.
• File History: only now, plug in your backup drive. Select Start, type File History, open it and choose Restore personal files.
• Another backup drive: plug it in and copy your files back.