What to do if you suspect ransomware

[[ransomware]] encrypts files and demands payment. The signs: files

that suddenly won't open, file names sprouting strange extensions, a

text file or wallpaper announcing your files are locked, or the

machine grinding while it happens. Minutes matter — ransomware

spreads to shared drives and other machines while it runs.

Do these, in order

1. Disconnect the machine from the network now. Unplug the

network cable and turn off Wi-Fi (airplane mode does it in one

switch). This is the single most valuable action — it stops the

spread.

1. Leave the machine ON. Don't power off, don't restart —

memory contents help responders determine what happened and

sometimes how to recover. Just disconnect and step away.

1. Call your IT support immediately — phone, not email. Say the

word "ransomware." If the machine with the problem is your only

phone-number source, use a colleague's machine. This outranks

every meeting on your calendar.

1. Warn people nearby to disconnect anything behaving the same

way — but don't have everyone power off; disconnect only.

1. **Don't pay, don't negotiate, don't click anything on the demand

screen.** That decision path belongs to the response, not to the

first ten minutes.

1. Don't try to clean it yourself — no antivirus-scan-and-hope,

no deleting the note, no restoring files onto a still-infected

machine.

Why speed beats everything

Backups and protections mean ransomware is usually a recoverable

event — if it's contained early. The difference between "one

machine re-imaged" and "a very long week" is almost always how fast

the first person acted. Reporting a false alarm costs five minutes

and zero embarrassment (how it likely arrived, for later reading:

KB-0021, KB-0030).

Afterwards

Follow the responders' lead on what's safe to reconnect and when.

The write-up will happen calmly later — your part was the

disconnect and the fast call, and if you did those, you did it

right.