← All situations Urgent — act now
My computer seems infected or my files are locked. What do I do?
First, breathe. Even if the screen looks like a catastrophe, the two most important things are simple: don’t pay and don’t make decisions in a panic. Disconnect the computer from the internet, ask for help, and go step by step. Panic is what does the most damage right now.
First steps, right now
- If a message demands money to "unlock" your files: don't pay. Paying doesn't guarantee you'll get them back, and it makes you an even better target.
- Disconnect the computer from the internet (unplug the network cable or turn off Wi-Fi), so the infection doesn't spread to other devices.
- Don't delete or format anything in a panic. If it's a work computer, tell your IT team now.
- Run a scan with the antivirus you have (Windows comes with Microsoft Defender included). If you can't manage it, ask someone tech-savvy for help.
- Change your important passwords from another, clean device (your phone, another computer) — not from the infected one.
- If you have a backup copy of your files, you'll be able to use it once the computer is cleaned — that's why backups matter.
What NOT to do
- Don't pay the ransom — you have no guarantee you'll get your files back.
- Don't use the computer for banking or passwords while it's infected.
- Don't install "clean-up tools" that appear in ads or pop-ups — they're often just another virus.
How to spot it next time
- The computer suddenly becomes very slow, pop-ups appear, programs start on their own.
- A full-screen message says your files have been "encrypted" and demands payment (usually in crypto).
- It usually gets in through an opened attachment, a pirated program or a fake "update".
This guide is meant to help you act fast. It does not replace official instructions from your bank, the police or the authorities. When in doubt, call the numbers above.