Everything here is general guidance, not professional advice. We research carefully and can still be wrong or out of date, so treat it as suggestions to check rather than instructions to follow, and accept that you act on it at your own risk. Full terms.

Disaster Lab
PlaybooksRansomware on a home computer
Datacritical30 minutes to prepare

Ransomware on a home computer

A home computer locked your files or the screen and is demanding payment. This is the household version, not a company network.

01DetectConfirm the signal
02ContainStop more damage
03RecoverRestore control
04VerifyProve it works

What do you need right now?

Your preparation

0 of 0 safeguards ready
0%
Continue the prevention checklist

What this means

Ransomware is malware that locks the computer or encrypts the files, then asks for money to unlock them. The FBI says you often find out when you cannot open your data, or when a message on the screen demands payment. It can arrive in an email attachment, an ad, a link, or a site that was hosting malware.

Paying is a bad bet. The FBI does not support paying a ransom. Payment does not guarantee you get the files back, and it pays the people who will do this to someone else. Europol’s No More Ransom project says the same thing, and adds that paying makes you a likelier target again. There is sometimes a free decryptor. There is not one for every family of ransomware.

If this computer is a company machine, or it shares files with a business network, stop and use Ransomware or destructive malware. That playbook is about customers, servers, and a team. This one is about your household PC and your own files.

Cloud sync can make it worse. If the encrypted files are inside a folder that syncs, the damaged copies can replace the good ones everywhere. That incident is Cloud sync deletes files everywhere.

Warning signs

  • A full-screen note demands payment, often in cryptocurrency, and gives you a deadline.
  • Documents and photos will not open, or the names gained a strange extension.
  • The desktop background changed to a ransom message.
  • You cannot sign in, and the only instructions on screen are how to pay.

A tech-support pop-up that says to call a phone number is a cousin of this, and sometimes it is only a scare. Do not call the number on the screen and do not install the tool they name. Disconnect first, then decide.

Recover now

First 15 minutes

  1. Disconnect the computer from the network. Unplug ethernet. Turn off Wi-Fi. No More Ransom says to do this as soon as you see a rogue process, so the malware has a harder time spreading to other devices and to disks that are still reachable.
  2. Do not pay, and do not start a chat with the address on the note. You would be funding the crime. You might also be handing them proof that this computer pays.
  3. Photograph the ransom note. Capture the whole screen, including any bitcoin address, deadline, and file extension. No More Ransom asks for the note later if you look up a decryptor. Do not type the address into your bank.
  4. Unplug backup disks. If an external drive was connected, it may already be encrypted. If it was not connected, leave it that way until you know the computer is clean.
  5. Leave the computer off the network. Do not “try one more reboot” into the same account and keep working. You can spread it, and you can overwrite files a decryptor might have needed.

Today

  1. Check for a free decryptor before you wipe anything. Go to nomoreransom.org yourself. Europol describes the Crypto Sheriff: you upload two encrypted files and the ransom note, it checks them against known tools, and if there is a match you get the tool. If there is no match, they say to check again later, because tools are added over time. No tool exists for every variant.
  2. Clean the malware only after you understand that cleaning does not unlock the files. No More Ransom says removing the ransomware stops new files being encrypted. It does not decrypt what is already locked. They mention that you may have to run antivirus from Safe Mode. Use the help built into your antivirus rather than a cleaner you found in an ad.
  3. Restore from a backup that was not connected during the attack. Copy files back only after the computer is clean, or restore onto a reinstalled system. If you have no backup, the honest outcome is often that those files stay encrypted. See Photos and files lost with no backup for what is still worth hunting, such as copies in email or on an old phone.
  4. Report it. No More Ransom says to report to your national police. In the United States, the FBI says to contact a local field office or file at ic3.gov. Include the note, the date, and how you think it arrived. A report does not decrypt the disk. It is how they build cases.
  5. Change passwords from a different device. The infected computer is a bad place to type your email password. Start with email, then banking, then anything you had saved in the browser on that machine.

Verify recovery

  • The computer is either reinstalled from a clean source, or your antivirus says the ransomware is gone and no new files are being encrypted.
  • You opened a restored document from the backup and it is the real file, not an encrypted stub.
  • The backup disk was not plugged in until that check passed.
  • You did not send payment. If you did, because someone convinced you, report that payment too. Crypto payments are covered in Cryptocurrency wallet drained.

After recovery

Assume passwords saved on that computer leaked. Replace them from the clean device. If the ransom note claimed they also stole copies of your files, watch for blackmail emails and do not pay those either. The FBI describes ransomware that both locks files and steals them. A home user should still not pay on the strength of a threat alone.

If the computer is used for work and customer data might be on it, tell your employer. Their duties are in the business playbook, not this one.

Prepare now

Backups

  • A backup runs on its own, and you have opened a file from it in the last month.
  • At least one copy is disconnected when the backup finishes. No More Ransom recommends a cloud copy and a physical copy, and says to disconnect the physical one when you are done.
  • The cloud account keeps older versions, so an encrypted file syncing up does not become the only copy. The checks are in Cloud sync deletes files everywhere.

The computer

  • The operating system and the browser update themselves.
  • You do not stay signed in as an administrator for ordinary use. Europol lists high-privilege daily use as something to avoid.
  • Email attachments and “invoice” downloads get a pause. You were not expecting the file, so you do not open it.

Practice

  • You have restored one folder from the offline backup onto a different folder, not over the originals, and the files opened.
  • Another device in the house can reach your email if this computer is unplugged.

Common mistakes

  • Paying because the deadline on the note feels real. The FBI and No More Ransom both say payment is not a reliable way to get the files, and it funds the next victim.
  • Plugging in the backup to “save the files” while the malware is still running. That can encrypt the backup too.
  • Wiping the disk before you check nomoreransom.org. A decryptor needs the encrypted files and the note. A wiped disk has neither.
  • Calling the phone number in a pop-up. That is the attacker, or someone who bought the same scare page.
  • Treating a home PC full of client files as a private problem. If other people’s data is on it, the business playbook and your obligations come next.

Sources

Last reviewed October 31, 2026Guidance changes. Confirm provider-specific actions in the linked official sources.