How to Remove Ransomware and Recover Your Files Without Paying

Key takeaways

• Disconnect first. Pull the network cable and turn off Wi-Fi before you do anything else, so the malware cannot spread or send data out.
• Free decryptors exist only for some strains. Identify yours at No More Ransom before spending time or money.
• Removing the malware does not decrypt your files. Cleaning and decrypting are separate jobs.
• Backups are the real answer. Keep one copy offline or immutable so ransomware cannot reach it.
• In India, report on cybercrime.gov.in and to CERT-In. Organisations have formal incident reporting duties.

What should you do in the first hour after a ransomware attack?

Stop the spread, preserve evidence and do not pay in a panic. The first hour matters more than any tool you will use later.

1. Disconnect. Unplug Ethernet and switch off Wi-Fi on the affected device. On a company network, tell IT immediately and isolate affected machines and shared drives.
2. Do not shut down yet if you are an organisation with forensic support. Memory can hold evidence. A home user can power the machine off once it is disconnected.
3. Photograph the ransom note and a few encrypted file names. Do not delete them. You need them to identify the strain.
4. Keep your backups safe. Disconnect external drives and cloud sync clients so they are not encrypted too.
5. Change passwords from a clean device: email, banking and any account used on the infected machine.

How do you identify the ransomware strain?

Look at the ransom note, the file extension that was added and any contact email. Upload the note and one small encrypted sample file to the identification tool on the No More Ransom site, which is run by law enforcement and security companies. Knowing the strain tells you whether a decryptor exists and whether the attackers also steal data (double extortion).

Can you decrypt files without paying the ransom?

Sometimes. No More Ransom lists free decryptors for specific strains, and several security vendors publish their own. For others there is no tool, because the encryption is correctly implemented and the key is held by the attackers. Be careful with three points:

• A decryptor works only for the strain it names. Using the wrong one can damage files, so work on copies.
• For STOP/Djvu, a widely seen strain spread with cracked software, a decryptor helps only when the files were locked with an offline key. Newer variants that used an online key are generally not recoverable this way.
• Large enterprise strains such as LockBit or BlackCat should not be assumed to be decryptable. Check, do not hope.

How do you remove the ransomware itself?

For a single home PC, boot into Safe Mode with Networking off and run a reputable anti-malware scan, for example Microsoft Defender Offline. Then check start-up entries and scheduled tasks. For anything important, the safer route is to wipe and reinstall the operating system from trusted media, then restore data. A machine that was fully compromised cannot be fully trusted just because a scan finds nothing.

Removal does not restore files. Those need a decryptor or a backup.

How do you restore files from backup?

Restore only after the system is clean. Check that the backup predates the infection, because some ransomware sits quietly for days. Test with a few files first. Windows shadow copies and restore points are often deleted by ransomware, so do not rely on them, but try them. Cloud storage with version history can sometimes roll back files; check the provider's help pages.

Should you pay the ransom?

The standard advice from law enforcement is not to pay. Payment does not guarantee a working decryptor, funds further attacks and may mark you as a repeat target. Some decisions are made under extreme pressure, for instance when a hospital cannot access patient systems. That is a decision for management, legal advice and incident responders, not something to settle from a blog post.

How do you report ransomware in India?

• Individuals: file a complaint on the National Cyber Crime Reporting Portal, cybercrime.gov.in. For financial fraud, the 1930 helpline is also used. Keep screenshots, the ransom note, wallet addresses and timestamps.
• Organisations: report to CERT-In, India's national agency for cyber incidents. Directions issued by CERT-In in 2022 set short reporting timelines for certain incident types, so check the current text on its website with your legal or compliance team. Sector regulators may add their own duties.

How do you prevent the next attack?

• Follow 3-2-1 backups: three copies, two media types, one offline or immutable. Test restores.
• Patch operating systems and internet-facing software promptly.
• Lock down Remote Desktop: no direct internet exposure, MFA, VPN.
• Use least privilege so a single user cannot encrypt the whole file server.
• Filter email, and train people to report suspicious attachments. Avoid cracked software.

Next steps

Ransomware response is a core blue-team skill. WebAsha's incident handler training covers detection and containment. For the attack side, read how ransomware attacks happen.

Related reading

• What is BERT ransomware and how does it target ESXi virtual machines?
• Lilu (Lilocked) Ransomware Started Infecting Thousands of Linux Servers Back to Back
• Top 10 Antivirus Solutions for 2026: Defend Against Cyberattacks