Ransomware screen appears: what to do?
Ransomware screen appears: the right reflexes in a few simple steps.
Quick answer
4 steps — read this before anything else
-
1
Disconnect the device from the network immediately.
-
2
Do not pay the ransom — no guarantee of recovery.
-
3
Take a photo of the message for authorities.
-
4
Restore from backups or call a professional.
Warning
Paying ransoms funds criminals and rarely restores files.
When a ransomware screen appears happens, the first minutes matter. Follow these steps to act safely and without panic.
What to do right now
- Disconnect the device from the network immediately.
- Do not pay the ransom — no guarantee of recovery.
- Take a photo of the message for authorities.
- Restore from backups or call a professional.
Mistakes to avoid
- Acting before removing the immediate source of danger.
- Panicking or skipping the official procedures.
- Following unverified advice from the internet.
How to prevent this in the future
Regular checks and keeping important documents and numbers in one safe place go a long way. Note the emergency number for your country and keep it visible at home.
Frequently asked questions
What should I do first?
Ensure everyone is safe, remove the source of danger, then call the relevant number or start the official procedure.
When should I call emergency services?
Whenever there is a risk to life, serious injury or a fire. When in doubt, call and let them decide.
Sources & references
Information verified with official organizations.
Spotted an error? Report it — we correct factual mistakes promptly.