Choose the response before starting cleanup
Keep the warning or detection details so you can describe the problem accurately.
Step 1 of 8
In this guide
- 01Which warning or behaviour are you seeing?
- 02Files encrypted or a ransom message: disconnect now
- 03Close the browser scam without engaging
- 04Disconnect from the internet
- 05Scan using the security program you have
- 06Review unfamiliar apps and startup items
- 07Clear the browser data and extensions
- 08Check accounts and protect passwords
Which warning or behaviour are you seeing?
Which warning or behaviour are you seeing?
Write down the exact warning, detection name or file name your security software shows. Signs worth checking include unexpected pop-ups, changed searches or homepages, apps or browser extensions you did not install, security turned off, messages sent without you, and unusual sign-in alerts.
Files that will not open, changed file names or a payment demand mean ransomware. A browser warning asking you to phone a number is usually a scam. Choose the option that matches below.
Choose the option that matches what you are seeing.
Files encrypted or a ransom message: disconnect now
Files encrypted or a ransom message: disconnect now
Turn off the modem and Wi-Fi immediately. Only turn the modem or Wi-Fi back on once the infected computer's Wi-Fi is off and its network cable is unplugged. The computer needs to be isolated so the ransomware does not spread to your other devices.
Disconnect the computer from the internet straight away: turn off Wi-Fi and unplug any network cable. Disconnect shared drives, and leave backup drives unplugged. If the computer is on a business network, disconnect it now.
Do not pay or reply to the attacker, and do not delete the ransom note or format the computer yourself. Keep the note and a few of the affected files so they can be checked.
Getting your files back
Book IT support below straight away. Ransomware cannot be cleaned off, so the computer has to be formatted and Windows reinstalled.
If you have a backup made before the attack, we format the computer, reinstall Windows and restore your files from the backup. Do not connect your backup drive to the infected computer, or the backup can be encrypted too.
If your files were syncing to OneDrive with Microsoft 365, OneDrive can restore all your files to a time before the attack (within the last 30 days). We do this from a clean computer, so the ransomware cannot encrypt them again.
If there is no backup or OneDrive copy and the computer has critical files on it, do not format the drive. It needs to go to a data recovery specialist, which we can arrange for you.
To be ready next time, see our backup guide.
Keep the computer disconnected until it has been dealt with.
Book IT supportClose the browser scam without engaging
Close the browser scam without engaging
Do not phone the number, let anyone take remote control, enter passwords or payment details, or download anything the warning offers.
Close the browser. If it will not close, press Ctrl + Shift + Esc, select the browser in Task Manager and choose End task. Then clean up the browser in the next step.
If the warning has gone and does not come back, you can stop here.
Disconnect from the internet
Disconnect from the internet
Disconnect the computer from the internet now, before you do anything else.
For Wi-Fi, select the network icon on the taskbar and turn Wi-Fi off. For a cable, unplug the network lead. Leave it disconnected while you check the computer.
Once it is disconnected, continue to the scan.
Scan using the security program you have
Scan using the security program you have
Your own security program
Open it and run a full scan. Follow its instructions for anything it finds. Do not delete your security software.
Windows Security only
- Open Windows Security > Virus & threat protection and choose Quick scan. If it finds something, or the problem continues, choose Scan options > Full scan > Scan now. A full scan can take a while; keep a laptop plugged in.
- For anything found, choose Quarantine or Remove. Do not choose Allow on device unless you know the file is safe.
- If a threat keeps coming back, save your work and choose Scan options > Microsoft Defender Antivirus (offline scan) > Scan now. The computer restarts to scan; do not turn it off. Afterwards, check the result in Protection history.
If the problem has stopped and the scan comes back clean, you can stop here.
Review unfamiliar apps and startup items
Review unfamiliar apps and startup items
Open Start > Settings > Apps > Installed apps and sort by install date. Search the name of any app you do not recognise before removing it. To remove an unwanted app, select its three dots and choose Uninstall. Do not remove Windows components, drivers, security software or work programs.
Then open Task Manager, select Startup apps, and Disable anything you have confirmed is suspicious. This stops it starting with Windows; it does not uninstall it.
If the problem has stopped and the scan comes back clean, you can stop here.
Clear the browser data and extensions
Clear the browser data and extensions
Clear browsing data
Edge: open Settings > Privacy, search, and services > Clear browsing data and select Choose what to clear. Set Time range to All time and tick everything, including Site permissions. Untick Passwords, unless you have your passwords saved somewhere else. Select Clear now. If you are signed in to Edge, this also clears the data on your other devices signed in to the same account.
Chrome: open the three-dot menu and select Delete browsing data. Set the time range to All time, tick everything and select Delete data.
You will need to sign in to websites again afterwards.
Extensions
In either browser, open Extensions > Manage extensions and remove any extension you did not install.
Homepage or search keeps changing
Edge: Settings > Reset settings > Restore settings to their default values. Chrome: Settings > Reset settings > Restore settings to their original defaults. Read the warning before you confirm.
If the pop-ups and changes have stopped, you can stop here.
Check accounts and protect passwords
Check accounts and protect passwords
In Start > Settings > Accounts > Other users, check for any account you did not create. Some are added by Windows or legitimate software, so do not remove one until you know what it is for.
If you think passwords may have been stolen, change them from a different computer you trust, not the affected one. Use a different password for each account, turn on multifactor authentication, and sign out any devices you do not recognise. Start with email, banking and your Microsoft or Google account.
If the malware keeps coming back after scanning, book IT support below.
Book IT supportFrequently asked questions
Does a pop-up telephone number mean I should call?
No. Do not call it or let anyone take control of your computer. Close the browser, using Task Manager if it is stuck, then clear the browser data.
Which scan should I use if I already have security software?
Run a full scan with your own security program and follow what it tells you. The Windows Security steps are for computers with no other security program. Do not delete your security software.
Can I connect my backup drive during a ransomware incident?
No. Keep it unplugged, or the backup can be encrypted too. Isolate the computer and book IT support straight away.
Should I change passwords on the affected computer?
No. Change them from a different computer you trust. Check recent sign-ins and recovery details too.
Does a clean scan guarantee everything is safe?
Not always. If the same threat keeps coming back or the problems continue, book IT support.
