How To Remove and Recover From Ransomware - Ransomware.org (2024)

Your first step is to disconnect …

… from the Internet and any external storage devices immediately upon detecting an attack. This contains the damage by preventing the malware from “phoning home,” and the damage from spreading to any backups that may reside on an external drive or cloud storage.

Investigate via your security software next. This will vary significantly depending on your operating system.

If you’re on a Windows machine, always…

… boot into Safe Mode (without Internet access) as a prerequisite to scanning. Booting into safe mode essentially boots you into a bare-bones instance of Windows in which most services not essential to the OS are prevented from starting. This is key because any nefarious service running in the background will likely do all it can to prevent you from reliably installing and running your removal tools.

Linux infections such as KillDisk and macOS infections such as FBI/MoneyPak require very different approaches, of course, but the broader principle nonetheless applies: immediately take the machine offline, disconnect external storage, and investigate using your choice of security tools.

Note that many ransomware programs …

… hijack your desktop background and replace it with “instructions” on how to send the attacker money. This background, though rendered benign and harmless by now, may still be in place even after removing the malware; if so, simply manually change your background to set it back to normal.

Ransom note left on systems infected by 2017’s WannaCry ransomware.

Variants observed included Egregor …

… Ryuk, Conti, Thanos, Ragnar, WastedLocker, Phobos/EKING, and BazarLoader. Of that count, one variant in particular, SMAUG, served as a Ransomware as a Service (RaaS) that offered attacks on Windows, macOS, and even Linux .

All operating systems are vulnerable to ransomware, though Windows is currently the most common target by far. According to AV-Test, 83.45% of ransomware attacks hit Windows machines as of Q1 2020 .

MacOS has thus far been a much smaller …

… target; nonetheless, such attacks have been no less severe. 2013’s FBI Ransom, while arguably not “true” ransomware, hijacked Safari browsers to convince users that paying a ransom was required to regain control.

In 2016, KeyRanger utilized legitimate developer certificates to ransom unlucky Mac OS X systems via the popular BitTorrent client, Transmission. 2017 introduced yet another ransomware attack, Patcher, which encrypted data on macOS machines.

To start with, never begin recovery …

… activities until after all traces of ransomware have been identified and verified as wholly removed from all systems. Some emergency situations, however, may demand immediate recovery to restore critical business operations. In such a scenario, perform all recovery steps on a separate system that’s in no way connected to the compromised system (i.e., on the same network). Failing to abide by one of these two options will simply result in compromising the data a second time.

Ideally, data can be restored without decrypting anything. Always keep important data backed up, either to an external device or synced with a cloud storage service. Then you can simply recover the original, unencrypted data from backup. The major caveat here is that any external devices or cloud services must be immediately disconnected once a machine is determined compromised, to ensure the attack doesn’t spread to those backups, as well.

In especially severe attacks …

… the ransomware may be so pervasive—against all efforts to remove it—that restoring decrypted data back to its original location will in fact trigger a second attack that re-encrypts it and sets all efforts back to square one. This can be avoided by restoring unencrypted data to a new, isolated location.

Full recovery may nonetheless require decryption. Some decryption methods do exist for a limited number of known ransomware variants.

For example, Malwarebytes focuses on …

… detecting and removing various forms of malware in general, but includes detection and removal of ransomware specifically. Similarly, many of the big-name security software suites (McAfee, Kaspersky, TrendMicro, and so on) include ransomware solutions.

Whatever solution you opt for, the ideal tool should first prevent ransomware, detect existing ransomware (via comprehensive and continually updated definitions), completely remove ransomware, and verify a clean system afterward.