What is ransomware and how to remove it

What is ransomware?

Ransomware is malware that takes something from you and offers to give it back for a payment. Microsoft defines it as malware that encrypts your files or stops you from using your computer until you pay money for them to be released ^[1]. The FBI adds that it can also block access to whole systems and networks ^[3].

In most cases what it takes is your files. It scrambles documents, photos, videos and databases with strong encryption, adds a new extension to their names and leaves a note that explains how to pay. The payment is almost always in cryptocurrency, and the note usually sets a deadline.

Ransomware is not limited to companies. Microsoft says it can target any PC, from a home computer to the servers of a government agency ^[1]. On our site, the guides readers open most are about home-user families such as Qqjj and Kkll, both versions of STOP/Djvu that ask individuals for a few hundred dollars.

Is ransomware a virus? The main types

People often call it a ransomware virus, but most ransomware does not copy itself into other files the way a classic virus does. It is a program that someone, usually the victim, starts by accident. A few families did spread on their own: WannaCry in 2017 moved between unpatched Windows PCs as a worm.

The word covers several kinds of attack, and the kind you have decides what you can still recover. No More Ransom, the joint project of Europol, police forces and security companies, lists encrypting ransomware, screen lockers, Master Boot Record lockers, web server ransomware and mobile ransomware ^[4].

How ransomware works: encryption and extortion

A ransomware run on a home PC takes minutes to a few hours. It adds a startup entry so it runs again, stops programs that hold files open and deletes Volume Shadow Copies, the snapshots behind Previous Versions and System Restore. Then it encrypts every drive it can write to and drops the note.

The encryption

Early ransomware used one key for locking and opening files, and security companies could often break it ^[4]. Modern families use two separate keys: a public one that encrypts and a private one, held only by the criminals, that is needed to decrypt ^[4]. No More Ransom gives CryptoLocker as the well-known example ^[4].

In practice each file is encrypted with a fast cipher such as AES or Salsa20, and that file key is then locked with the attacker's public key. The private key never touches your PC, so there is nothing to find and nothing to guess. Renaming the files or running a cleaner cannot reverse it.

Online and offline keys

When the ransomware can reach its server, it gets a unique key for your PC. That is an online key, and only the attackers have it. When it cannot connect, many families fall back to a built-in offline key that many victims share. STOP/Djvu works this way, and its free decryptor helps only people whose files were locked with an offline key researchers have collected.

Double extortion and data leak sites

Against companies, encryption is often only half the threat. CISA describes how attackers first copy data out, then threaten to release it if the victim does not pay; using both tactics is called double extortion ^[5]. Some groups skip encryption and only threaten to publish what they stole ^[5].

The stolen data ends up on a leak site, a page on the Tor network where the gang names victims and posts their files when the deadline passes. A company that restores everything from backups still has a data breach to handle, with duties to tell customers and regulators.

Ransomware as a service (RaaS)

Large groups such as LockBit run like a franchise. Developers build the encryptor, the payment chat and the leak site, then rent them to affiliates who break into networks and share each ransom with them. That split is why one brand can hit thousands of victims and why a police takedown of one brand rarely ends the attacks.

Home-user ransomware and enterprise gangs

The ransomware a home user meets is a different business from the one in the news. Knowing which side you are on tells you what to expect from the note, the price and the chances of recovery.

STOP/Djvu, the family most home users meet

STOP/Djvu is behind more of our guides than any other family. Each version adds its own four-letter extension, such as .qqjj, .kkll or .hlas, and leaves the same _readme.txt note. The note asks for $980, or $490 if you write within 72 hours, and offers to decrypt one file for free.

Djvu spreads almost entirely through cracked programs, game cheats and activators from torrent and warez sites. It often brings a password stealer along, so treat every password saved on that PC as exposed. Your personal ID at the bottom of _readme.txt tells you whether an offline key might exist: IDs ending in t1 are usually offline.

Other families you may see at home

Not every short extension is Djvu. Zxcvb is a Dharma variant, with an ID and an email address in each file name and a different set of tools. Dharma and Phobos notes often appear as info.hta pop-ups, and their operators usually get in through Remote Desktop rather than a crack.

Enterprise gangs

Business attacks look very different. Sophos surveyed 3,400 organizations in 17 countries that were hit in the past year ^[6]. Exploited vulnerabilities were the most common root cause at 32%, ahead of compromised credentials at 23%, malicious email at 19% and phishing at 18% ^[6]. The FBI and CISA publish #StopRansomware advisories on gangs such as Akira, Interlock, Medusa and Gunra ^[3].

How ransomware gets on your computer

Ransomware does not appear on its own. Microsoft lists unsafe or fake websites, unexpected attachments and bad links in email, social media and chat messages among the usual ways in ^[1]. The FBI adds clicking an ad and visiting a site embedded with malware ^[3]. These are the routes we see most.

1. Cracked software, keygens and torrents. Pirated programs, activators, game cheats and mods are the main channel for STOP/Djvu. Our page on what cracked software really installs explains why the "turn off your antivirus first" instruction is the giveaway.
2. Malicious email attachments. No More Ransom says ransomware is typically delivered as an attachment, which can be a program, an archive or an image ^[4]. Invoices, delivery notes and CVs are the usual cover. See how to spot phishing emails.
3. Fake installers and fake updates. Search ads and look-alike download sites hand out installers that set up the real program plus a hidden payload.
4. Remote Desktop with a weak password. Attackers scan the internet for PCs with Remote Desktop open, guess or buy the password and start the ransomware by hand.
5. An earlier infection. A loader or trojan that arrived weeks before can download ransomware later.
6. Unpatched software. Exploited vulnerabilities were the top root cause in the Sophos survey ^[6], and No More Ransom notes that web server ransomware uses known flaws in content management systems ^[4].

Signs of ransomware: notes, extensions and wallpapers

Most people notice ransomware only when it has finished. The FBI says victims usually find out when they can no longer open their data or see a message demanding payment ^[3]. Microsoft adds that the message often appears after the files are already encrypted ^[1].

Some signs show up while it is still running: the disk light stays on, fans run hard and file icons change as you watch. If you catch it then, disconnect at once. Detection names can look confusing; our guide to antivirus detection names explains what Generic and Gen mean.

What to do first if ransomware hits

The order matters more than speed. Our ransomware recovery checklist covers every step in detail. This is the short version.

1. Disconnect. Turn off Wi-Fi or pull the network cable, then unplug USB disks and backup drives. Microsoft notes that ransomware on a networked PC may spread to other computers and storage ^[1]. CISA's checklist says to power a machine down only if you cannot disconnect it.
2. Do not pay yet. You can decide about payment later, with facts. Read should you pay the ransom before you write to anyone.
3. Photograph the note and the screen. Copy the note and two or three encrypted files to a USB stick you can wipe later. Keep every encrypted file.
4. Identify the family. Upload the note and a sample file to ID Ransomware, or use Crypto Sheriff on No More Ransom, which is built to find the type of ransomware and check for a decryption tool ^[4].
5. Remove the ransomware before you restore anything. Microsoft says to clean the PC with Windows Security before you try to recover files ^[1]. The steps are in the next section.
6. Recover what you can, then change passwords from a clean device and report the attack.

How to remove ransomware from Windows

Removal does one job: it stops the ransomware from running again and encrypting new files. It does not decrypt the files it already locked. Stay offline until you finish these steps.

1. Open Windows Security, then Virus & threat protection, then Scan options, and run a Full scan ^[2]. Quarantine everything it finds, and note the detection names.
2. Run a Microsoft Defender Offline scan from the same Scan options page. Microsoft explains that it scans after a restart without loading Windows, so persistent malware has a harder time hiding or defending itself ^[2]. Our guide on the Defender Offline scan shows each screen.
3. Check the results in Windows Security under Protection history ^[2].
4. If the ransomware blocks Windows Security, start Windows in Safe Mode with Networking and scan from there. In Windows 11 open Settings, then System, then Recovery, then Advanced startup; in Windows 10 the same option is under Update & Security, then Recovery.
5. Open Settings, then Apps, then Installed apps, and sort by install date. Uninstall the cracked program, activator or "installer" that came in around the time the files changed.
6. Remove what the scan may have left: startup entries, scheduled tasks and files in %AppData% and %LocalAppData% with random names. Our malware leftovers guide walks through each place.
7. Check that Tamper protection is on under Virus & threat protection settings, so no app can quietly switch Defender's protection off again ^[2].
8. If the PC still behaves oddly, or you cannot trust it again, decide whether to clean up or reset Windows. Copy the encrypted files off first if you hope to decrypt them later.

A second-opinion scanner helps if Defender finds nothing but the files keep changing. Microsoft Safety Scanner is free and runs alongside your main antivirus. For help with a stubborn case, ask in our Windows help forum.

How to remove ransomware from a Mac

File-encrypting ransomware for macOS is rare. Researchers have found a few real cases over the years, but nearly every Mac "ransomware" report we get is a browser page that claims the Mac is locked and asks for a call or a payment.

• If Safari or Chrome shows a lock screen, force quit the browser with Command, Option and Escape. Reopen Safari while holding Shift so it does not restore the scam tab.
• Never call the number on the page. These pages are tech support scams, not encryption.
• If files really have a new extension and will not open, disconnect the Mac and stop Time Machine from backing up the encrypted copies.
• Remove unknown apps from Applications and check login items in System Settings, then General, then Login Items & Extensions.
• Restore the files from a Time Machine backup made before the attack, once the Mac is clean.

Our Mac viruses guide covers the Mac threats you are far more likely to meet, from adware to password stealers.

How to remove ransomware from Android and iPhone

Phone "ransomware" is mostly screen lockers and fake police pop-ups. No More Ransom says Android devices can be infected through drive-by downloads and fake apps posing as popular services such as Adobe Flash or an antivirus product ^[4]. The FBI describes the classic version: a screen that freezes with a message, supposedly from the FBI, claiming you broke the law and must pay a fine ^[3].

Android

1. Start the phone in Safe mode, which pauses third-party apps. On most phones you press and hold Power off on the power menu until Safe mode appears; the exact steps differ by phone maker.
2. Open Settings, then Security or Security and privacy, then Device admin apps, and remove admin rights from any app you do not recognize.
3. Open Settings, then Apps, and uninstall the app that appeared just before the lock screen. Look for fake video players, system updaters and "security" apps.
4. Restart normally and run a Play Protect scan from the Play Store.
5. If the lock screen is only a browser page, clear that site's data in Chrome and do not tap anything on it.

More phone cases are on our Android topic page.

iPhone and iPad

Apps on iPhone cannot reach the files of other apps, so encrypting ransomware is not a practical threat there. What iPhone owners meet is a Safari page that claims the phone is locked, or a scammer who got the Apple Account password and locked the device remotely. Close the tab and clear Safari history and website data; if your account was taken over, change the password from a trusted device.

How to get encrypted files back

Once the PC is clean, check every way back before you think about paying. Each one has its own detailed page.

• Backups. A disk that was unplugged during the attack is not affected. Plug it in only after removal is complete.
• OneDrive. Microsoft says OneDrive has built-in ransomware detection and recovery plus file versioning, so you can restore earlier versions ^[1]. The Ransomware data recovery section in Windows Security guides you through restoring from OneDrive ^[2].
• Shadow copies and Previous Versions. Ransomware tries to delete them, but it sometimes fails. See shadow copies and Previous Versions after ransomware.
• A free decryptor. No More Ransom says files can be decrypted when the authors made a mistake, published their keys, or police seized a server with keys on it ^[4]. Our list of free ransomware decryptors shows which families have one and how to use it safely.
• Copies elsewhere. Photos sent in chats, files attached to old emails and documents on a work PC are often the fastest way back for the files that matter most.

If a decryptor says it has no key for your files, keep them. No More Ransom notes that it sometimes gets only part of the keys and asks victims to keep checking ^[4]. Keys for older families still appear years after the attacks.

Should you pay the ransom?

The FBI does not support paying, because payment does not mean you will get data back and it encourages more attacks ^[3]. No More Ransom adds that bugs in the malware can make files unrecoverable even with the right key ^[4]. Some attackers never answer at all. Our page on whether to pay a ransomware ransom sets out the facts and the risks.

How to report a ransomware attack

Reporting helps police link cases and sometimes recover keys. In the United States, report to the FBI's Internet Crime Complaint Center at ic3.gov or to your local FBI field office ^[3]. In the United Kingdom, Microsoft points to Action Fraud ^[1].

If you already paid, Microsoft advises you to contact your bank and the local authorities at once, because a card payment can sometimes be blocked and returned ^[1]. Our list of where to report cybercrime by country covers the rest of the world. Then change your passwords from a clean device, starting with email and banking, and turn on two-step verification. Our guide to securing your accounts after malware gives the full order.

How to protect yourself from ransomware

Prevention is mostly about one goal: an attack must never take the only copy of your files. The rest makes the attack less likely to start.

• Keep a backup that ransomware cannot reach. CISA's guidance is to keep offline, encrypted backups and test that they restore ^[5]. The FBI says backups must not stay connected to the computers they back up ^[3]. Our 3-2-1 backup guide for Windows shows how to set this up at home.
• Turn on Controlled folder access. In Windows Security open Virus & threat protection, then Manage ransomware protection, and switch Controlled folder access on ^[2]. It protects Documents, Pictures, Videos, Music and Desktop by default, and you can add folders under Protected folders ^[2].
• Set up Ransomware data recovery on the same page so OneDrive keeps copies you can restore ^[2].
• Do not install cracked software, activators or game cheats. They are the main source of STOP/Djvu on home PCs.
• Keep Windows, browsers and apps updated, and keep antivirus set to update and scan automatically ^[3][1].
• Turn off Remote Desktop if you do not use it, under Settings, then System, then Remote Desktop.
• Be careful with attachments and links you were not expecting ^[1].

If Controlled folder access blocks an app you trust, select the notification and add it as an allowed app ^[2]. Microsoft warns to add apps carefully, because an allowed app that gets compromised can change your protected files ^[2]. Our best ransomware protection guide compares tools that add more layers.

When to use a ransomware removal tool

Be clear about what a scanner can and cannot do. A security tool removes the ransomware program and what it left behind, so it cannot encrypt new files. No scanner can decrypt files that were already encrypted, because it does not have the attackers' private key. Be wary of any "decryption software" sold through pop-ups or ransomware forums.

Start with Microsoft Defender, which is already on your PC, and a Defender Offline scan. A second tool helps when Defender keeps finding the same threat, when you cannot tell what installed it, or when Windows itself was damaged during the infection. Our Fortect review explains how its scan finds malware leftovers and repairs damaged Windows files after removal.

Not sure a download or site is safe before you open it? Run it through our link check first. For a specific extension or note name, search the ransomware guides on this page, starting with the STOP/Djvu collection.