Removing ransomware is the smallest part of recovery. The encrypted files stay encrypted, and the attacker often still has access. Isolate affected systems, preserve evidence, call your incident response contacts, find how they got in, rebuild affected machines from clean images and restore data from backups you have verified.
Why is "removal" the wrong goal?
An antivirus tool may quarantine the encryptor, but the intruder usually spent time in the network before running it. CISA's #StopRansomware Guide explains that attackers have also adopted double extortion, where they steal data and threaten to publish it as well as encrypt files. Cleaning one machine neither returns the data nor ends the theft.
So treat it as an incident with an unknown scope. The guide has two parts: prevention best practices, and a response checklist. This post gives a plain-language outline. Use the full checklist during a real event.
What should happen in the first hours?
Isolate, do not destroy. Disconnect affected devices from the network by unplugging the cable or disabling wireless, and block the compromised accounts. Avoid wiping machines yet, because memory and disks hold evidence. Whether to power a machine down depends on your forensic plan and should be decided by your responders.
Activate your plan and people. Call the incident response lead, legal counsel, your insurer if you have a policy, and an external responder if you need one. Law enforcement and CISA accept reports and can help.
Preserve evidence. Keep ransom notes, sample encrypted files, logs and any malware samples. Note times and actions as you go.
Protect the backups. Check that backup systems are not encrypted or reachable by the attacker's credentials. Disconnect them if there is doubt.
Scope it. Identify which systems, accounts and data are involved. Look for signs of data theft, not just encryption.
How do you find the way in?
NIST's incident response recommendations, SP 800-61 Rev. 3, place incident response inside wider cybersecurity risk management and stress learning from incidents. Practically, you need the initial access route: a phished account, an exposed remote access service, a vulnerable internet-facing system, or stolen credentials. Without closing it, the attacker or another one comes back.
Review remote access logs, identity provider logs, recently created accounts, new scheduled tasks and remote management tools you did not install.
A constructed example
A 90-person firm finds its file server encrypted at 6 a.m. The IT lead disconnects the server and two workstations, calls the firm's incident response retainer, and locks all administrator accounts. Responders find the entry point was a remote desktop gateway protected only by a password, reached with credentials from an old breach. They also find a new administrator account created nine days earlier. The firm rebuilds the domain controllers and servers from clean images, resets every credential, enables multi-factor authentication on the gateway, and restores data from an offline backup taken two days before the encryption began. Names and timings are invented.
What does safe recovery involve?
Rebuild, do not clean. For systems the attacker touched, reinstall from trusted media. Reset all credentials, including service accounts and API keys, and rotate secrets that were stored on affected machines. Restore data from verified backups, scanned before reconnection. Bring systems back in priority order, watching for renewed activity.
On paying a ransom, involve legal counsel and law enforcement before any decision. Payment does not guarantee a working decryptor or stop publication of stolen data.
How to check or apply this
- Write down now who to call, including after hours.
- Keep offline or immutable backups, and test a restore every quarter.
- Isolate affected hosts and compromised accounts at once. Do not wipe them before evidence is captured.
- Identify the entry point and close it.
- Hunt for persistence: new accounts, scheduled tasks, remote tools.
- Rebuild from clean images, reset credentials and rotate secrets.
- Restore from verified backups and monitor closely after reconnection.
- Meet legal notification duties if data was taken, and hold a review within weeks.
Quick check
Can antivirus decrypt my files?
Usually not. Security software may remove the malware, but files stay encrypted unless a decryptor exists for that strain or you have backups.
Should I turn the infected computer off right away?
Disconnect it from the network first. Whether to power it off depends on evidence needs, so ask your responders if you can.
Sources
- CISA #StopRansomware Guide
- CISA #StopRansomware resources
- NIST SP 800-61 Rev. 3, Incident Response Recommendations
Last reviewed: 18 October 2026.
