What to Do After a Ransomware Attack on Your Home Computer

A ransom note on your screen, files you can no longer open, a new file extension you don’t recognize on everything in your Documents folder – if this just happened on a home computer, the first hour matters more than anything you do afterward. This guide walks through what to do right now, what to avoid, and how to check your home network before you plug everything back in.

What ransomware on a home computer usually looks like

Most home ransomware infections show up in one of two ways: a full-screen message demanding payment to unlock your files, or files that simply won’t open anymore, often renamed with an unfamiliar extension. Sometimes there’s no note at all yet – just files that stopped working and a computer that feels slower or behaves strangely. If you’re not sure whether what you’re seeing is ransomware or something else, treat it as ransomware until you know otherwise. The response steps below are safe either way.

Step 1: Disconnect the computer from the network – don’t shut it down yet

Unplug the Ethernet cable or turn off Wi-Fi on the affected computer immediately. This stops the ransomware from spreading to other devices on your home network and cuts off any connection it may have to whoever is controlling it.

Resist the instinct to power the machine off or restart it right away. Some ransomware is built to trigger additional damage on shutdown or reboot, and a clean shutdown can also make later data recovery attempts harder. Disconnect the network first; decide what to do with the machine itself afterward.

If you have other devices on the same network – other computers, a NAS, smart home hubs – assume they could be exposed too until you’ve checked them. Ransomware that arrived through a shared drive or a synced folder can reach other machines on the same network in minutes.

Step 2: Don’t pay the ransom

Paying a ransomware demand does not guarantee that your files will actually be decrypted. There is no enforcement mechanism behind a criminal’s promise, and sending payment confirms that your device is a paying target, which can invite further attacks. Law enforcement guidance consistently advises against paying for exactly these reasons.

If your files matter enough that you’re considering payment, that’s a strong signal you need a real backup strategy going forward – see the recovery and prevention sections below.

Step 3: Figure out what’s actually infected

Before you touch anything else, get a rough picture of the damage:

• Which folders or drives have encrypted or renamed files?
• Is an external drive or a network share that was connected at the time also affected?
• Do you recognize the ransom note or file extension? A quick search for the exact extension or the wording of the note can tell you which ransomware family you’re dealing with, which sometimes matters for whether a free decryption tool exists.
• Were any cloud-sync folders (like a synced Documents or Desktop folder) connected? If so, the sync service may have already pushed encrypted versions of your files to the cloud, overwriting good copies – check your cloud provider’s version history before you do anything else with that account.

Write this down somewhere, even just in a notes app on your phone. It helps you decide what needs to be restored and gives you something concrete if you end up needing help from a professional.

Step 4: Remove the infection – the reliable way

For a home computer, the most reliable way to be confident an infection is fully gone is a clean operating system reinstall, not just an antivirus scan. Ransomware and the tools that delivered it can leave behind components that a single scan misses, especially if the infection involved a compromised admin account or scheduled task.

A practical sequence:

• Boot from trusted install media (a USB drive with the OS installer, created on a separate, clean device) rather than trusting the infected installation to clean itself.
• Back up anything you need from the infected drive to a separate, quarantined location first – but don’t restore it onto a clean system yet. Encrypted or infected files copied over can undo the reinstall.
• Perform a full reinstall rather than a “repair” or “reset that keeps my files” option, since those can leave the infection intact.
• Reinstall applications from official sources rather than restoring an old application backup, which could reintroduce whatever let the ransomware in.

If a full reinstall isn’t realistic for you, a reputable antivirus/anti-malware scan followed by a second opinion scan from a different tool is the next-best option, but treat the result cautiously – a clean scan does not guarantee the system is fully clean, since some techniques are built to evade signature-based detection.

Step 5: Restore your files from backup – carefully

This is the step that makes the whole ordeal survivable. If you have backups that were disconnected or otherwise isolated from the infected machine at the time of the attack, you’re in a strong position.

• Only restore from a backup you’re confident predates the infection. If you don’t know exactly when the infection started, restore from the oldest backup that still has what you need, then work forward.
• Restore onto the freshly reinstalled system, not the infected one.
• Scan the restored files before opening them, particularly anything that was an executable or a macro-enabled document.
• If your only backup was a drive that was connected to the infected machine at the time of the attack, check it carefully before trusting it – some ransomware specifically looks for and encrypts connected backup drives.

If this experience is the first time you’ve thought seriously about backups, the standard approach worth adopting going forward is the 3-2-1 rule: at least three copies of your data, on two different types of storage, with one copy kept offline or disconnected from your network. A drive that’s only plugged in during the backup itself, then disconnected, is far more resilient than one left connected all the time.

Step 6: Check your home network before reconnecting everything

Once the infected machine is clean and your files are restored, don’t just plug it back into the same network and move on. Ransomware and the malware that delivers it sometimes change network-level settings that outlast the infection itself, and a compromised device can also affect other devices sharing the same router.

Check whether your DNS was tampered with

Some malware changes DNS settings on an infected device, or occasionally on a router itself, to reroute your traffic through a resolver the attacker controls. Run a DNS leak test on the recovered device and compare the resolvers it reports against what you’d normally expect (your ISP’s resolver or whichever public resolver you deliberately configured). Unfamiliar DNS servers showing up is worth investigating further before you trust the connection.

Check your VPN configuration, if you use one

If the infected machine had a VPN client installed, its configuration could have been altered without your knowledge. Run a VPN leak test to confirm the VPN, if you’re using one, is actually routing traffic the way you expect rather than leaking your real IP or DNS queries outside the tunnel.

Check if your home IP address ended up on a blacklist

If the infected device was recruited into sending spam or scanning other systems before you caught it, your home IP address could have been flagged by email or security blacklists in the meantime. An IP blacklist checker will tell you if that happened – useful to know if your outgoing email suddenly starts landing in spam folders after this incident.

Check the router itself

A computer infection alone doesn’t usually compromise a router, but it’s worth ruling out, especially if you noticed unusual devices or settings changes around the same time. A separate guide on securing a router after malware walks through resetting credentials, checking for unauthorized port forwarding rules, and updating firmware – worth a look if anything about your network still feels off.

Step 7: Change your passwords – from a different, clean device

Don’t reuse the freshly-reinfected machine to change your passwords until you’ve confirmed it’s clean; if a keylogger or credential stealer was part of the infection, typing new passwords on that machine could just hand them over again. From a separate, trusted device, change the passwords for anything that was logged in on the infected computer – email, banking, cloud storage, and especially any account with saved payment details. Turning on multi-factor authentication where it isn’t already enabled adds a real layer of protection here, since a stolen password alone becomes far less useful to an attacker.

Step 8: Reconnect devices one at a time

Bring the cleaned computer back onto the network first, run your checks, and give it some time before assuming everything else on the network is unaffected. If you have other devices that were connected to the same network at the time of the infection – other computers, phones, tablets, smart home devices – it’s worth a quick look at each for anything unusual, particularly devices that shared files or a network drive with the infected machine.

Preventing the next one

Ransomware usually arrives through a small number of well-worn paths: a malicious email attachment or link, a compromised download, an exposed remote desktop connection, or an out-of-date piece of software with a known weakness. None of these require expensive tools to close off:

• Keep backups on the 3-2-1 pattern, with at least one copy genuinely disconnected from your network most of the time.
• Keep your operating system and applications updated – many infections rely on vulnerabilities that were already patched by the time the attack happened.
• Be cautious with email attachments and links, especially anything urging you to enable macros in a document or run an installer you weren’t expecting.
• Turn on multi-factor authentication for your important accounts, so a leaked password alone isn’t enough to get in.
• If you use remote access software to reach your home computer from elsewhere, make sure it’s current and protected with a strong, unique password rather than left on default settings.

None of this makes a home network immune – no combination of tools can guarantee that. What it does is meaningfully shrink both the chance of an attack succeeding and the damage if one does, and it turns a ransomware incident from a potential total loss into an afternoon of restoring from backup.

Frequently asked questions

Should I ever pay a ransomware demand?

Paying does not guarantee that your files will be decrypted, and it marks you as a target willing to pay. Law enforcement guidance generally advises against it. If you’re weighing payment because you have no backup, treat this incident as the reason to set one up immediately afterward.

Can I just run an antivirus scan instead of reinstalling the whole system?

A scan can remove many infections, but it cannot guarantee the system is completely clean, since some techniques are built to evade signature-based detection. A full reinstall from trusted media is the more reliable option when you’re able to do it.

My backup drive was connected to the computer when it got infected – is it safe to use?

Not necessarily. Some ransomware specifically searches for and encrypts connected backup drives. Check the backup carefully – ideally from a separate clean device – before trusting it, and if it turns out to be affected, look for an older backup or cloud version history that predates the infection.

How do I know if the ransomware spread to other devices on my home network?

Look for the same symptoms – files that won’t open, unfamiliar extensions, ransom notes – on any device that shared a network drive, synced folder, or file share with the infected machine. If you’re unsure, disconnect those devices too until you can check them individually.

Why does my network still look different after I cleaned the infected computer?

Some malware alters DNS settings or network configuration in ways that outlast the infection on the device itself. A DNS leak test can help confirm whether your traffic is still being routed the way you expect.

Is it worth reporting a ransomware attack on a personal computer?

Reporting to your country’s relevant cybercrime reporting channel can help authorities track ransomware activity, even for individual, non-business incidents. It won’t recover your files, but it contributes to broader efforts against the groups running these campaigns.