Answers to Common Questions about Ransomware
Ransomware stops you from using your PC. It holds your PC or files for “ransom”. This page describes what ransomware is and what it does, and provides advice on how to prevent and recover from ransomware infections.
You can also read our blog about ransomware: The 5Ws and 1H of ransomware.
On this page:
What does ransomware do?
There are different types of ransomware. However, all of them will prevent you from using your PC normally, and they will all ask you to do something before you can use your PC.
They can target any PC users, whether it’s a home computer, endpoints in an enterprise network, or servers used by a government agency or healthcare provider.
- Prevent you from accessing Windows.
- Encrypt files so you can’t use them.
- Stop certain apps from running (like your web browser).
Ransomware will demand that you pay money (a “ransom”) to get access to your PC or files. We have also seen them make you complete surveys.
There is no guarantee that paying the fine or doing what the ransomware tells you will give access to your PC or files again.
Frequently asked questions
- Is it true that the legal authorities in my area have detected illegal activities in my PC?
No. These warnings are fake and have no association with legitimate authorities. The message uses images and logos of legal institutions to make the it look authentic.
- I cannot access my PC or my files. Should I just go ahead and pay to regain access?
There is no one-size-fits-all response if you have been victimized by ransomware. There is no guarantee that handing over the ransom will give you access to your files again. Paying the ransom could also make you a target for more malware.
- How do I get my files back?
How to recover your files depends on where your files are stored and what version of Windows you are using.
Before you try to recover files, you should use Windows Defender Offline to fully clean your PC.
For Microsoft Office files stored, synced, or backed up to OneDrive
- OneDrive creates a version of Microsoft Office files when you save or change the file as part of its security features.
- To see if there are older versions of your file, go to OneDrive on the web. Right-click on a file you want to restore and click Version history.
- OneDrive for Business customers should see the Manage document versions help article on the Office help site.
For files on your PC
- You need to have turned on File History (in Windows 10 and Windows 8.1) or System Protection for previous versions (in Windows 7 and Windows Vista) before you were infected. In some cases, these might have been turned on already by your PC manufacturer or network administrator.
- Some ransomware will also encrypt or delete the backup versions of your files. This means that even if you have enabled File History, if you have set the backup location to be a network or local drive your backups might also be encrypted. Backups on a removable drive, or a drive that wasn’t connected when you were infected with the ransomware, might still work.
- See the Windows Repair and recovery site for help on how to enable file recovery for your version of Windows.
If you’ve been infected by the Crilock family of ransomware (also called CryptoLocker), you might be able to use the tool mentioned in the MMPC blog:
- What should I do if I’ve paid?
You should contact your bank and your local authorities, such as the police. If you paid with a credit card, your bank may be able to block the transaction and return your money.
The following government-initiated fraud and scam reporting websites may also help:
- In Australia, go to the SCAMwatch website
- In Canada, go to the Canadian Anti-Fraud Centre
- In France, go to the Agence nationale de la sécurité des systèmes d’information website
- In Germany, go to the Bundesamt für Sicherheit in der Informationstechnik website
- In Ireland, go to the An Garda Síochána website
- In New Zealand, go to the Consumer Affairs Scams website
- In the United Kingdom, go to the Action Fraud website
- In the United States, go to the On Guard Online website
If your country or region isn’t listed here, we encourage you to contact your country’s federal police or communications authority.
For general information on what to do if you have paid, see:
- How did message know my IP address?
Your IP address is not usually hidden, and there are lots of tools online that will get it for you. It’s likely they used such a tool.
- How did ransomware get on my PC?
In most instances ransomware is automatically downloaded when you visit a malicious website or a website that’s been hacked.
For other ways malware, including ransomware, gets on your PC, see:
- How do I protect myself against ransomware?
- Install and use an up-to-date antivirus solution (such as Microsoft Security Essentials).
- Make sure your software is up-to-date.
- Avoid clicking on links or opening attachments or emails from people you don’t know or companies you don’t do business with.
- Ensure you have smart screen (in Internet Explorer) turned on.
- Have a pop-up blocker running in your web browser.
- Regularly backup your important files.
You can backup your files with a cloud storage service that keeps a history or archive of your files, such as OneDrive which is now fully integrated into Windows 10 and Windows 8.1, and Microsoft Office.
After you’ve removed the ransomware infection from your computer, you can restore previous, unencrypted versions of your Office files using “version history”.
See the question “How do I get my files back?” above for more help on how to use this feature in OneDrive.
For more tips on preventing malware infections, including ransomware infections, see:
- How do I remove ransomware from my PC?
How to remove the ransomware depends on what type it is.
If your web browser is locked
You can try to unlock your browser by using Task Manager to stop the web browser’s process:
- Open Task Manager. There are a number of ways you can do this:
- Right-click on an empty space on the taskbar and click Task Manager or Start Task Manager.
- Press Ctrl+Shift+Esc.
- Press Ctrl+Alt+Delete.
- In the list of Applications or Processes, click on the name of your web browser.
- Click End task. If you are asked if you want to wait for the program to respond, click Close the program.
- In some workplaces, access to Task Manager may be restricted by your network administrator. Contact your IT department for help.
When you open your web browser again, you may be asked to restore your session. Do not restore your session or you may end up loading the ransomware again.
See the question “How do I protect myself from ransomware” above for tips on preventing browser-based ransomware from running on your PC.
If your PC is locked
- Method 1: Use the Microsoft Safety Scanner in safe mode
First, download a copy of the Microsoft Safety Scanner from a clean, non-infected PC. Copy the downloaded file to a blank USB drive or CD, and then insert it into the infected PC.
Try to restart your PC in safe mode:
When you’re in safe mode, try to run the Microsoft Safety Scanner.
- Method 2: Use Windows Defender Offline
Because ransomware can lock you out of your PC, you might not be able to download or run the Microsoft Safety Scanner. If that happens, you will need to use the free tool Windows Defender Offline:
See our advanced troubleshooting page for more help.
Steps you can take after your PC has been cleaned
Make sure your PC is protected with antimalware software.
Microsoft has free security software that you can use:
- If you have Windows 10 or Windows 8.1, your PC comes with antimalware software: Windows Defender.
- If you’re using Windows 7 or Windows Vista, you should install antimalware software, such as Microsoft Security Essentials.
- You can update Microsoft security software on our updates page.
If you don’t want to use Windows Defender or Microsoft Security Essentials, you can download other security software from another company. Just make sure it is turned on all the time, fully updated, and provides real-time protection.
- Open Task Manager. There are a number of ways you can do this:
Details for home users
There are two types of ransomware – lockscreen ransomware and encryption ransomware.
Lockscreen ransomware shows a full-screen message that prevents you from accessing your PC or files. It says you have to pay money (a “ransom”) to get access to your PC again.
Encryption ransomware changes your files so you can’t open them. It does this by encrypting the files – see the Details for enterprises section if you’re interested in the technologies and techniques we’ve seen.
Older versions of ransom usually claim you have done something illegal with your PC, and that you are being fined by a police force or government agency.
These claims are false. It is a scare tactic designed to make you pay the money without telling anyone who might be able to restore your PC.
Newer versions encrypt the files on your PC so you can’t access them, and then simply demand money to restore your files.
Ransomware can get on your PC from nearly any source that any other malware (including viruses) can come from. This includes:
- Visiting unsafe, suspicious, or fake websites.
- Opening emails and email attachments from people you don’t know, or that you weren’t expecting.
- Clicking on malicious or bad links in emails, Facebook, Twitter, and other social media posts, instant messenger chats, like Skype.
It can be very difficult to restore your PC after a ransomware attack – especially if it’s infected by encryption ransomware.
That’s why the best solution to ransomware is to be safe on the Internet and with emails and online chat:
- Don’t click on a link on a webpage, in an email, or in a chat message unless you absolutely trust the page or sender.
- If you’re ever unsure – don’t click it!
- Often fake emails and webpages have bad spelling, or just look unusual. Look out for strange spellings of company names (like “PayePal” instead of “PayPal”) or unusual spaces, symbols, or punctuation (like “iTunesCustomer Service” instead of “iTunes Customer Service”).
Check our frequently asked questions for more information about ransomware, including troubleshooting tips in case you’re infected, and how you can backup your files to help protect yourself from ransomware.
Details for enterprises and IT professionals
The number of enterprise victims being targeted by ransomware is increasing. Usually, the attackers specifically research and target a victim (similar to whale-phishing or spear-phishing – and these in fact may be techniques used to gain access to the network).
The sensitive files are encrypted, and large amounts of money are demanded to restore the files. Generally, the attacker has a list of file extensions or folder locations that the ransomware will target for encryption.
Due to the encryption of the files, it can be practically impossible to reverse-engineer the encryption or “crack” the files without the original encryption key – which only the attackers will have access to.
The best advice for prevention is to ensure company-confidential, sensitive, or important files are securely backed up in a remote, un-connected backup or storage facility.
In some cases, third-party tools released by some security firms are able to decrypt files for some specifically ransomware families. See our blog FireEye and Fox-IT tool can help recover Crilock-encrypted files for an example. Tim Rains, Microsoft Director of Security, released the blog Ransomware: Understanding the risk in April 2016 that summarizes the state of ransomware and provides statistics, details, and preventative suggestions to enterprises and IT professionals: Our Threat intelligence report: Ransomware also includes suggestions on prevention and recovery, statistics, and details.
How big is the ransomware problem?
Ransomware is a global problem. The US, Italy, Russia, Korea, and Spain saw the most ransomware encounters in 2016.
After exploding in the past couple of years, ransomware encounters seem to have begun to decline. However, this trend is not a reflection of the email and exploit kit campaigns that try to install ransomware on computers. Rather, it is a sign of better blocking of attacks by security software like Windows Defender Antivirus. All in all, millions of computers still encountered ransomware in 2016.
We’re still seeing significant amounts of email that carry ransomware downloaders. A total of 500M of these emails are being sent out every quarter. The email attachments reach millions of computers, but a lot of them are blocked from downloading and executing ransomware.
In 2016, we tracked over 200 ransomware families. Over half of these families were discovered only in 2016, which means that cybercriminals are constantly releasing new ransomware in the wild. Cerber and Locky were the most prominent ransomware families in 2016.