Tell-tale signs of ransomware
Real ransomware typically shows several of these together:
- Files have new extensions you did not put there (e.g.
.locked,.encrypted,.lockbit,.djvu, random strings like.zxcv). - A text or HTML 'ransom note' file appears in every folder — names like
readme.txt,HOW_TO_DECRYPT.html,!RECOVER.txt. - Your wallpaper changes to a black screen with payment instructions.
- Files won't open in any application — Word reports them as corrupt, photos won't display.
Step 1: Stop using the PC
Disconnect from the internet (unplug Ethernet, turn off Wi-Fi).
Do not reboot. Many ransomware families finish encrypting on shutdown or run more passes on boot.
Disconnect any external drives, USB sticks and unplug network shares.
Important
If only a few files are affected and the wallpaper has not changed, you may have caught it mid-encryption. Speed matters — disconnect now and continue.
Step 2: Confirm it is not just OneDrive / sync issues
Open File Explorer. If files have a green tick or cloud icon next to them and won't open, that is OneDrive showing files that are not currently downloaded — not ransomware.
If the file extension is unchanged and only one app refuses to open them, the file may just be corrupt. Try opening it in a different application.
Step 3: Identify the ransomware family
From another device (not the infected one), go to id-ransomware.malwarehunterteam.com.
Upload the ransom note plus one encrypted file. The site will tell you which ransomware family it is and whether a free decryptor exists.
Cross-check the result against nomoreransom.org — the EU-led project lists every public free decryptor.
Tip
A surprising number of older ransomware families have free decryptors available. Always check before paying.
Step 4: Photograph evidence
Take phone photos of: the ransom note, the changed wallpaper, the file extension list, and any contact email/Bitcoin address.
You will need this if you report to police or your cyber insurer.
Was this guide helpful?
Know someone who needs this? Send them the guide.
JD
Written by
Jordan DicksonFounder, CyberSecurityGuides
Founder of CyberSecurityGuides, writing practical, jargon-free guides that help everyday people recover from and protect against online attacks.
Reviewed by CSG Security Engineers