Ransomware in user profile folders: a recovery path

When ransomware targets your user profile folders and encrypts them, visible damage can spread rapidly across Desktop, Documents, Downloads, Pictures and application data. Windows profiles normally sit under C:\Users\<name>, while Mac profiles are commonly found in /Users/<name>. Disconnect the affected computer from networks and removable storage immediately; deleting the profile or reinstalling Windows can destroy useful recovery evidence.

Encrypted files may still contain recoverable data, but the malware must be contained before restoration begins. This sequence applies to Windows and Mac systems and covers preserving files, assessing a decryptor, reviewing an extortion message and reducing the risk of another profile-folder attack.

Isolate the device and stop encryption

Disconnect the machine from Wi-Fi, Ethernet and attached USB storage. If it is using a phone hotspot, disconnect the computer from that connection. Do not access email, online banking or cloud storage from the infected system. If filenames or file sizes are still changing, avoid repeated restarts because temporary encryption keys may exist in memory.

Windows Task Manager and Mac Activity Monitor may reveal a suspicious process generating heavy disk activity. Record relevant process names before terminating anything, and end a process only when its behaviour clearly matches the attack. Avoid downloading an unknown “ransomware stop” utility, particularly from a forum or message attached to the ransom note.

Once file activity has stopped, leave the computer powered off. Do not reconnect it to the network, an external drive or a shared folder until the malware has been identified and the intended recovery process is understood.

Preserve profile files and recovery options

Treat the affected profile folders as evidence rather than ordinary damaged data. Do not delete encrypted files, rename their extensions, empty the Recycle Bin or run a factory reset. Removing files does not remove ransomware that may already be running with administrator privileges or stored outside the profile.

A qualified technician can create a complete copy of the affected drive for specialist analysis. If professional imaging is unavailable, preserve an untouched copy on clean, disconnected storage while following a safe recovery procedure. Keep at least one separate copy because antivirus cleaning, failed decryption and restoration attempts can alter files.

Check previous backups, cloud version histories and unopened offline copies. A dated backup may contain the clean version of an encrypted file, but do not restore it over the current profile until the malware is removed. Ransomware commonly deletes Windows shadow copies, so backup availability must be verified rather than assumed.

Handle demands and report the attack

Keep the ransom note, payment address, threatened deadline and representative filenames. Photograph the note instead of opening suspicious links or attachments. For an extortion message directing payment through an onion service, Tor payment demands explains the payment method and associated risks. A demand does not prove that the attacker copied the files or can actually decrypt them.

Australian users can report the incident to the Australian Government’s ReportCyber service and follow Australian Cyber Security Centre guidance. Businesses should also contact their cyber insurer, managed service provider or incident-response specialist. Reporting the malware identifier, affected file extensions and device operating system can help others recognise the same campaign.

A ransom note quoting Australian dollars does not establish that the attacker is local. Wallet addresses and criminal infrastructure may be overseas, and cryptocurrency transfers are generally difficult to reverse. An Australian organisation should assess its obligations under the Privacy Act 2023, including whether the Notifiable Data Breaches scheme and notification to the Office of the Australian Information Commissioner apply.

Reset accounts and rebuild trust

Use a different, clean device to change passwords, beginning with the Microsoft, Google or Apple account linked to the profile. Then update email, banking and cloud-storage credentials. Enable multi-factor authentication, revoke unfamiliar sessions and remove unauthorised applications or device connections that could allow the attacker to regain access.

Saved browser data, email rules and authentication tokens may have been exposed before encryption began. Review account recovery details, forwarding addresses and password resets, and remove activity that the user did not initiate. A password reset alone may be insufficient if an attacker retains an active authenticated session.

Households and small businesses in Sydney, Melbourne, Brisbane or Perth should map each person’s synced Desktop and Documents locations before restoration. This prevents an employee’s OneDrive or Google Drive copy from being mistaken for an independent backup and gives a local IT provider a clear record of affected accounts.

Clean the system and prevent recurrence

After files and evidence are preserved, rebuilding the operating system from trusted installation media is often safer than trying to clean an unknown profile. Cleaning outside Windows can remove active malware before it restarts with the operating system. These bootable antivirus rescue media steps explain how to scan an infected device offline and when a rescue scan is insufficient.

A rescue scan cannot restore encrypted files or guarantee that every persistence mechanism has been found. Keep backup drives disconnected until the rebuilt computer is clean. If files remain encrypted, identify the exact ransomware family and test only an authorised decryptor written for that family and file extension; no universal decryptor exists.

Australian consumers can compare locally priced endpoint-protection subscriptions and backup services when choosing ongoing security. Keep automatic, versioned backups, apply operating-system updates promptly and use standard user accounts for everyday work. Retain one offline recovery copy until encrypted documents have been validated and the rebuilt device is secured.