Self HelpBoise Computer Care

Malware & scams

Ransomware or files suddenly renamed and locked

Files renamed, locked and a ransom note? Disconnect now, protect your backups, don't pay, report it, and get professional recovery help.

Difficulty
Advanced
Time
Act now
Steps
6
Updated

Sounds like this?

  • Files have strange extensions and won't open
  • A ransom note text file appears
  • Wallpaper changed to a payment demand

Step by step

  1. Disconnect the computer from the internet and your network.
  2. Unplug USB drives and backup drives.
  3. Don't turn it off or delete files yet. Take photos of the ransom note.
  4. From a different device, change passwords for email and banking.
  5. Report it to the FBI at ic3.gov.
  6. Get professional help to check for a known decryptor, restore from clean backups, and rebuild the system.

Related error codes & messages

Quick answers

When should I stop and get professional help with "Ransomware or files suddenly renamed and locked"?

Stop and get help if: Stop here and get help. Ransomware cleanup needs a professional. Boise Computer Care can diagnose it for a $60 fee; call 208-996-3508.

How long does this fix take and how hard is it?

Plan on Act now. Difficulty: Advanced.

Is it safe to try this myself?

Mostly, if you follow these precautions: Disconnect from the network immediately (unplug Ethernet, turn off Wi-Fi) to stop it spreading to other devices and backups. Unplug external backup drives right away. Don't pay. Paying doesn't guarantee your files back.

Which error messages or codes does this guide cover?

.locked, README.txt ransom note, Your files have been encrypted.

Still stuck?

Ask Fyx365 AI

Describe the problem in plain English and get guided, step-by-step help. Start on the free plan; Pro is $9.99/month. BCC is an official Fyx365 partner.

Still stuck? Ask Fyx365 AI (free plan)

Want a pro?

Book a repair at BCC

  • Diagnostic$60
  • Shop repairs$100/hr
  • On-site$100/hr + $100 visit

10504 W Fairview Ave, Boise ID · Fri–Wed 10 AM–8 PM · Closed Thursday

Book a repair at BCCCall 208-996-3508

Related guides

  1. Malware & scams 'Your PC is infected' scam pop-up Full-screen warning with a phone number Easy5-15 minWindows Defender Security WarningError # 0x80073b01Your computer has been locked
  2. Malware & scams Browser pop-ups and redirects that won't stop Ads pop up everywhere Easy15-30 min
  3. Malware & scams Fake tech-support phone scam: what to do if you called Someone called claiming to be Microsoft, Apple, Amazon or your bank Medium30-90 min
  4. Malware & scams Is free antivirus enough? Antivirus trial expired Easy10 minVirus & threat protection is managed by your organizationThreat found