Short answer: stop using the machine, keep the encrypted files exactly as they are, and check for backups and shadow copies before you consider paying. Paying is a gamble with no guarantee, and it funds the next attack. It is a last resort, not a first response.
First, stop the damage
- Disconnect from the network. Unplug the cable, switch off Wi-Fi. Encryption of network shares and cloud-synced folders continues while the machine is connected.
- Do not reboot repeatedly. Some families finish their work on restart, and some leave decryption keys in memory that a reboot clears.
- Do not delete anything, including the ransom note. It identifies the family, and identification is what makes recovery possible.
- Do not plug in your backup drive. If it is not already connected, keep it that way until someone has looked.
Work out what you are actually dealing with
Three questions decide everything:
- Which family is it? The note and the file extension usually name it. Some families have public decryption tools; most do not.
- Do you have a backup that was disconnected? If yes, the answer is restore, not pay.
- Are shadow copies intact? Windows keeps previous versions of files. Sometimes they survive, and restoring from them costs nothing.
This is the point where a professional assessment is worth more than an opinion: identifying the family takes minutes and determines whether there is a free path out.
What paying actually buys
Sometimes working decryption. Often nothing. The things worth understanding before money moves:
- You are dealing with criminals who have no obligation to help you, and a business model built on repeat customers.
- Paying marks you as someone who pays. Second attacks on the same victim are common.
- The decryptor itself can be faulty, and a failed decryption on files that were not backed up is the end of them.
- In many jurisdictions, paying a sanctioned group can create legal exposure.
None of that makes paying impossible. It makes it a decision to take with your eyes open, after the free options have been ruled out.
Why this is worse for a business machine
A home PC loses photos. A work machine may hold client records, patient data or payment information, and there may be a legal duty to report the incident. That does not change the technical steps above, but it changes who needs to be told, and how quickly.
What to do next, concretely
- Photograph the screen and the note.
- Keep the machine off the network, and keep it powered if it is a laptop — do not let the battery die mid-investigation if you can avoid it.
- Get the family identified before anything is deleted or reinstalled.
- Check backups, shadow copies, and any cloud folder that synced before the encryption started — version history can be the cheapest recovery there is.
Questions people ask
Will paying get my files back? Maybe. There is no enforceable promise, and the decryptor can fail. Treat it as a bet, not a purchase.
Can antivirus remove it? It can remove the program. It cannot decrypt your files. Those are two different problems and the second one is the one that hurts.
Should I reformat and start fresh? Only after the encrypted files have been preserved and the family identified — otherwise you have thrown away the only evidence and the only chance of decryption.