Home / Antivirus

Ransomware protection basics

6 min read · Updated November 2026

Ransomware locks your files and demands payment to release them. No single tool stops every attack, so the goal is several small layers plus a backup you can restore from.

How it usually arrives

• Email attachments or links that look like invoices or delivery notices.
• Pirated or unofficial software installers.
• Outdated software with known security holes.
• Weak or reused passwords on remote access tools.

Build your layers

1. Update everything. Install Windows, browser and app updates promptly.
2. Keep Defender on. Real-time and cloud-delivered protection should both be enabled (see the Defender setup guide).
3. Enable Controlled folder access. In Windows Security, open Ransomware protection and switch it on to guard Documents, Pictures and other folders.
4. Back up offline. Keep one backup copy on a drive that is unplugged when not in use, plus a cloud copy with version history. See the backup guide.
5. Think before you click. Check the sender address, hover over links and be careful with unexpected attachments, especially Office files asking you to enable macros.
6. Use a standard account for daily work and an administrator account only for installing software.
7. Protect remote access. Turn off Remote Desktop if you do not use it and use strong, unique passwords with two-step sign-in.

If your files are locked

1. Disconnect the PC from Wi-Fi and the network straight away.
2. Do not restart repeatedly or delete the ransom note. It can help identify the strain.
3. Photograph the message, then run a Full and an Offline scan with Defender.
4. Check nomoreransom.org for free decryption tools for known strains.
5. Restore from your clean backup after the PC has been cleaned. Consider a Windows reset if the infection persists.
6. Report the incident to your local cybercrime authority. In the US, use the FBI Internet Crime Complaint Center at ic3.gov.