Disconnect first, before anything else
The single most important step is to stop the computer from talking to the internet or to any other device on your network. Turn off Wi-Fi, unplug the network cable, or turn off the router itself. This can stop the problem from spreading to other computers in your home and stops it from doing further damage to files.
Do not restart the computer repeatedly trying to fix it yourself, and do not plug in an external drive to "save" files before it has been checked. Both can make the situation worse.
- Disconnect the computer from Wi-Fi or unplug the network cable
- Turn off the router if you are not sure which device is affected
- Do not plug in backup drives or other devices yet
- Leave the computer as it is until it can be looked at
Do not pay before getting advice
It is tempting to just pay the ransom to make the problem go away, but paying does not guarantee your files come back, and it can mark you as a target for future attempts. Get an honest assessment of your options first. In many cases there are other paths to recovering what matters, and in some cases the demand is a bluff with nothing actually encrypted.
What we can and cannot promise
We will look at what has happened and tell you honestly what is recoverable. Sometimes files can be restored from a backup you already have, even one you forgot about. Sometimes only some files are affected and others are untouched. In other cases, recovery without paying is genuinely not possible, and we will say so directly rather than promise something we cannot deliver.
Either way, our first job is to remove the ransomware itself and make sure it cannot spread further or come back.
Backups, so this does not happen again
Once things are stable, the real fix going forward is a backup that runs automatically, so your photos and documents exist safely in a second place no attacker can reach from your computer. We set this up so you never have to remember to do it yourself.
Call (615) 852-5565 Monday to Saturday, 8:00 AM to 8:00 PM. Disconnect the computer first, then call, and we will walk you through what happens next.
Need patient, local help?
These Deskside services are the closest match for this guide.