Ransomware defense

Make your files worthless to hold hostage

Ransomware encrypts your files and demands payment. You win by having an untouchable backup and by making it hard to get in. Tick these off as you go.

Protection checklist

0/8 done

Keep a 3-2-1 backup3 copies of important files, on 2 different kinds of storage, with 1 kept offline or in the cloud with version history. Unplug the backup drive when it is not in use.
Turn on folder protectionWindows: Windows Security > Virus & threat protection > Ransomware protection > Controlled folder access. It blocks unknown apps from changing your documents.
Install updates within a weekMost ransomware enters through known, already-patched bugs. Turn on automatic updates for your OS, browser and Office.
Use a standard account day to dayCreate a separate administrator account and use a non-admin account for daily work, so malware cannot change system settings silently.
Turn on two-factor authenticationEnable it for email, cloud storage and banking. A stolen password alone is then not enough to lock you out or delete your cloud backups.
Disable Remote Desktop if unusedExposed Remote Desktop is a leading ransomware entry point. Turn it off, or only allow it behind a VPN.
Pause before opening attachmentsBe suspicious of unexpected invoices, shipping notices or "urgent" requests, especially .zip, .iso, .js or macro-enabled Office files.
Test a restoreOnce a quarter, restore a single file from your backup. A backup you have never restored is only a hope.

If you have been hit

Disconnect the computer from Wi-Fi and unplug network cables immediately. Do not turn it off.
Unplug any external drives and backup disks so they are not encrypted too.
Take a photo of the ransom message. Do not pay; payment does not guarantee your files back.
Check nomoreransom.org for a free decryption tool for that ransomware family.
Report it at ic3.gov (US) or your national cybercrime agency.
From a different, clean device, change your email, banking and other important passwords.
Wipe and reinstall the computer, then restore files from a backup made before the attack.