Step-by-step guide to deleting malware that holds your files for ransom

Ransomware is malicious software designed to block access to files, encrypt documents, or threaten to publish stolen data. It may arrive through a phishing attachment, compromised website, fake software update, exposed remote desktop service, or a malicious browser extension. Acting quickly can limit further damage, although removing the infection does not automatically decrypt affected files.

This step-by-step guide to deleting malware that holds your files for ransom focuses on containment, safe malware removal, and responsible file recovery. The instructions apply mainly to Windows systems, with equivalent security checks available on macOS.

Do not open encrypted files repeatedly, rename them, or install random “guaranteed” decryptors. Some recovery tools are fraudulent, while poorly tested software can overwrite useful evidence or make restoration harder.

Recognize the signs of a ransomware infection

Common warning signs include file names changing unexpectedly, documents becoming unreadable, ransom notes appearing in multiple folders, and desktop wallpaper displaying payment instructions. A sudden increase in disk activity, unfamiliar processes, or disabled security software can also indicate that ransomware is running.

Record the ransom note, altered file extensions, contact addresses, and the approximate time the incident began. Photograph or copy the note if necessary, but avoid visiting payment portals or opening suspicious attachments. This information may help researchers identify the ransomware family and determine whether a legitimate decryptor exists.

Disconnect the infected device

Immediately disconnect the computer from Wi-Fi and unplug its Ethernet cable. Remove external drives, USB storage, and network shares if they are not currently needed. Ransomware can spread through connected resources, including shared folders and backup devices.

If several computers use the same network, disconnect them from one another and alert the person responsible for the network. Do not shut down a business server without considering operational needs, but isolate it as quickly as possible. Stopping communication may prevent the malware from encrypting more files or reaching additional devices.

Preserve evidence before removing anything

Avoid deleting ransom notes, suspicious files, or logs before documenting the incident. Write down the device name, affected accounts, visible symptoms, and any recent downloads or email messages. If the computer contains important business or legal information, contact an incident-response professional before making major changes.

Check whether clean backups exist, but keep them disconnected until the infected system has been examined. Cloud synchronization can spread encrypted versions across devices, so pause syncing where possible. If files are stored on a shared drive, temporarily disable access rather than allowing the ransomware to continue modifying them.

Remove the malicious software safely

On Windows, restart into Safe Mode when the malware prevents normal security tools from running. Safe Mode loads a limited set of drivers and services, which can make it easier to identify and remove a ransomware loader. From there, update a reputable antivirus or anti-malware program and run a full system scan.

Review recently installed applications, scheduled tasks, startup entries, browser extensions, and unfamiliar administrator accounts. Remove only items you can confidently identify as malicious; ransomware often uses legitimate system components to hide its activity. If a browser extension appears suspicious, follow this malicious extension guide for additional cleanup steps.

On macOS, use the latest security updates, inspect Login Items and browser extensions, and run a trusted malware scan. If the security program cannot clean the system, consider restoring the operating system from a verified installer after preserving necessary evidence. Change important passwords from a separate, clean device because ransomware incidents may involve credential theft.

Action	Purpose	Important caution
Disconnect networks	Stops communication and lateral spread	Do not reconnect shared drives prematurely
Enter Safe Mode or use a clean rescue tool	Limits active malware processes	Follow the security vendor’s instructions
Scan with updated protection	Detects loaders and related threats	Avoid several competing security tools at once
Preserve encrypted files	Keeps recovery options open	Do not rename or overwrite originals
Restore from clean backups	Returns usable files safely	Verify the system is clean first

Determine whether file recovery is possible

After removing the ransomware, identify the encrypted file extension and search reputable security resources for the malware family. Some ransomware strains have free decryptors created from flaws in their encryption process, leaked keys, or seized criminal infrastructure. A specialist database or the ransomware information section may provide identification advice and current recovery news.

Never assume that a tool is safe because it promises instant recovery. Download decryptors only from recognized cybersecurity organizations or law-enforcement-supported projects, and scan the tool before use. Make a complete copy of encrypted files first, then test the decryptor on a small set of duplicates.

If no decryptor exists, restore from offline backups, version history, or protected cloud snapshots. File-recovery software may help when the ransomware only deletes originals rather than securely overwriting them, but recovery becomes less likely as the device continues operating. Keep encrypted files archived in case a working key or decryptor becomes available later.

Reduce the chance of another attack

Once recovery is complete, patch the operating system, browsers, VPN software, and applications. Remove unsupported programs, disable unnecessary remote access, and require strong unique passwords with multifactor authentication. Regularly test backups by restoring sample files instead of assuming that a backup job completed successfully.

Use these practical safeguards:

• Keep at least one backup offline or protected from ordinary account access.
• Enable automatic updates for the operating system and security software.
• Treat unexpected invoices, login alerts, and document attachments as suspicious.
• Limit administrator privileges and use separate accounts for daily activity.
• Train household or workplace users to report unusual pop-ups and encrypted files immediately.

Review email rules, browser settings, and account activity after cleanup. If sensitive information may have been stolen, reset credentials, notify affected organizations, and follow applicable breach-reporting requirements.

Ransomware removal is safest when containment comes first and recovery comes second. Disconnect the device, preserve evidence, clean it with trusted tools, and restore only from verified sources. Begin with the affected computer today, document every step, and consult a qualified cybersecurity professional when the files or systems are especially important.