You boot up your home computer and find your photos and documents renamed with a strange extension, alongside a note demanding money. That is the moment ransomware stops being an abstract headline and becomes a personal crisis. The guidance issued by No More Ransom — the portal run by Europol and the Dutch police — and by Spain’s INCIBE follows a clear sequence: cut the network connection, refuse to pay, photograph the ransom note, clean the machine, restore from a backup or hunt for a free decryptor, and file a report. If you have no backup and no decryptor exists for your variant, the honest answer is that those files may be gone for good. Paying does not guarantee otherwise.
- Disconnect first: Pull the network cable, disable Wi-Fi and unplug external drives, USB sticks and any connected NAS to stop the infection spreading.
- Never pay: Official guidance is categorical that payment guarantees nothing and marks you as a repeat target.
- Cleaning is not decryption: Removing the malware stops further encryption but does not unlock files already scrambled.
- Backups decide the outcome: An offline copy made before the attack is the only reliable recovery path.
Step one: sever the connection before anything else
The first instruction in the No More Ransom user guide is to disconnect the computer from the internet and from every other network, including the home Wi-Fi. The logic is simple: it prevents the infection from spreading. In a household that means unplugging the Ethernet cable, switching off the machine’s wireless adapter and detaching external disks, USB memory sticks and any NAS device. If your OneDrive, Google Drive or iCloud folder syncs automatically, going offline also stops encrypted files from overwriting the healthy versions stored in the cloud.
One nuance worth knowing: in a September 2024 advisory on social-engineering campaigns attributed to North Korea, the FBI recommended leaving the affected machine powered on so that forensic traces useful to investigators are not lost. If you intend to report the attack and want the computer analysed, disconnecting it from the network does not require shutting it down.
Step two: do not pay, document the note and clean the system
No More Ransom is blunt: paying is not recommended under any circumstances. Its FAQ gives two reasons. The practical one is that payment guarantees nothing, because the malware itself may contain errors that prevent data recovery even with the correct key. The deeper one is that every payment proves to criminals that the business model works — and, as the user guide adds, victims who pay are likely to be targeted again. For a household, that argument carries particular weight: a private individual who pays once joins the list of people who pay.
Before doing anything else, photograph or screenshot the ransom note. It serves two purposes: identifying which variant infected you and supporting your police report.
Next, run an antivirus or anti-malware scan to remove the ransomware; you may need to boot Windows in safe mode to do so. No More Ransom clarifies something many people do not expect: removing the ransomware does not decrypt your files. It only stops the malware from encrypting the files that remain intact while you work on recovering the rest. The order matters — clean first, then restore, so you never lay a backup over a still-infected system.
Step three: recovering files when you have a backup
If you hold a copy made before the infection, restore it. That is the most reliable route and the only one that does not depend on luck. No More Ransom recommends keeping two copies, one in the cloud and one physical on an external disk or USB drive, and disconnecting that drive after every backup precisely so an attack cannot reach it.
Microsoft documents two concrete aids for OneDrive users. Its ransomware detection feature alerts you when OneDrive files have been attacked and guides the restoration; according to Microsoft’s support pages, non-subscribers get the first notification and first recovery free of charge. The option to restore OneDrive to an earlier point in time undoes all changes from the last 30 days, but only with a Microsoft 365 subscription.
Step four: no backup? Look for a free decryptor
Without a backup, the next stop is nomoreransom.org, which collects free keys and tools capable of unlocking files held by various ransomware families. Its Crypto Sheriff tool identifies which variant hit you: you upload two encrypted files plus the ransom note, and the system checks them against its key database, as INCIBE explains.
Keep expectations realistic. The site itself warns that not every ransomware type has a solution and that in many cases, once the attack has run, little can be done without a backup. When a decryptor does exist, it is usually for one of three reasons the portal lists: the authors made coding mistakes (as with Petya and CryptXXX), they published the keys themselves (the case of TeslaCrypt), or police seized servers containing keys (CoinVault). A sensible corollary: if no decryptor exists for your variant today, do not delete the encrypted files — store them on a separate disk. No More Ransom keeps adding tools; as of November 2026 its front page listed new decryptors for families including Phobos/8base, FunkSec and DoNex.
Step five: report the crime and rebuild
The final step in the No More Ransom guide is to report the attack to police; its reporting page points Spanish users to the channels of the Policía Nacional and the Guardia Civil. Bring the photo of the note, the new file extension and any suspicious email or download from the preceding days.
If you do not know where to start, INCIBE’s Tu Ayuda en Ciberseguridad service operates the 017 line, free and confidential, from 08:00 to 23:00, 365 days a year. It also answers via WhatsApp on 900 116 117 and via Telegram under the handle @INCIBE017. Afterwards comes rebuilding: change passwords from a clean device and update the system. No More Ransom insists on installing operating-system and application updates as soon as they ship.
What stands out most about the official guidance is how little it promises. None of it says you will get your photos back; all of it says the disconnected backup decides the outcome. That is the useful lesson of home ransomware: on the day of the attack there is nothing brilliant left to do, only an orderly sequence to avoid making things worse. The decisions that mattered were made, or not made, weeks earlier. As for paying, the position is clear: even when it occasionally works, it amounts to buying a lottery ticket from the person who just robbed you — no guaranteed prize, and a certainty that they will be back.