Recommended Free Tools
iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
If ransomware is suspected, treat the event as an active intrusion—not merely a file-recovery problem. Activate your incident-response plan, isolate affected systems without destroying volatile evidence, determine whether the attacker still has access, report through the appropriate channels, eradicate the compromise, and restore only into a verified clean environment.
The sequence below follows U.S. federal guidance while identifying where decisions depend on your systems, contracts, jurisdiction, and legal advice. It is an organizational response guide, not a substitute for qualified incident-response or forensic assistance.
What to do in the first hour
The first objective is to stop the attacker from spreading or deploying encryption more widely while preserving enough evidence to understand what happened. CISA’s joint #StopRansomware Guide puts the immediate action plainly: determine which systems were impacted and isolate them immediately.
Free tools Windows power users keep installed
One-click scans. No signup required.
1. Activate the incident-response plan
Declare an incident under your organization’s approved response plan and assign an incident lead. Bring together security, infrastructure, identity, cloud, backup, communications, legal, risk, and the affected business owners. Record the time the incident was declared, who has decision authority, and which communication channel is being used for coordination.
#1 Best Overall
- Powerful Turbo Fan:CAGIWIRU Electric Air Duster have reached speed up to 130000RPM,Can efficient remove dust and debris.With LED light and Three Adjustable Speed to meet with different cleaning tasks.
- With Attached USB C Fasting Charging cable.Charing 3 hours,Enjoy up to 240 minutes of use on the lowest setting, For third speed can use for 25mins.with four charging options to meet with your needs.
- Wide Application: attached 5 different nozzles,making it suitable for a variety of scenes, such as car,pet, pc, keyboards, and other electronic devices. It also serves for office and home clean duster.
- Handy Design & Portable:Cordless air duster electric nozzle is Light weight and small size, design and comfortable to hold and space saving, convenient to carry around. You can put it in your room or inside the car without taking up space.
- Economical &Reusable: Built durable materials with a long-lasting battery,our CAGIWIRU air duster it's a sustainable alternative to disposable air cans.
Assume that ordinary email, chat, shared documents, or ticketing systems may be monitored or controlled by the intruder. Use an out-of-band channel—such as voice calls or a prearranged emergency communications system—when feasible. Limit sensitive operational details to the people who need them; an attacker who sees your containment plan may change tactics or accelerate deployment.
2. Identify and isolate affected systems
Start with the systems showing ransom notes, mass file renames, suspicious encryption activity, disabled security tools, or other confirmed indicators. Also identify systems that communicated with the suspected hosts or share accounts, administrative paths, or network segments with them.
| Situation | Preferred containment action | Important trade-off |
|---|---|---|
| One or a few identifiable hosts | Isolate each host through endpoint controls, switch-port shutdown, firewall rules, or physical network disconnection. | Individual isolation can preserve service for unaffected systems, but it may miss a host that has not yet shown visible symptoms. |
| Several systems or a subnet are affected | Consider taking the relevant network segment offline at the switch level, as CISA recommends for multiple affected systems. | Network isolation is faster and broader, but it can interrupt critical operations and may hide useful live telemetry if performed without a collection plan. |
| Cloud workloads or virtual machines | Apply security-group, identity, and routing containment, then take volume snapshots for later forensic review. | Snapshot and access changes must be coordinated with the cloud team so that evidence is preserved without allowing continued attacker access. |
Do not assume that a powered-off computer is the safest first step. If the host can be disconnected another way, preserve it in its current state while the response team collects volatile evidence. CISA warns that shutting down can eliminate artifacts held in memory. If immediate mitigation is impossible and leaving the device connected would allow continued spread, powering it down may be necessary; document who made that decision and why.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Fix the driver behind crashes, sound loss and screen glitches3Clear out junk files and repair common Windows errorsHow to preserve evidence without allowing further damage
Evidence is often lost quickly during a ransomware event. Focus first on artifacts that disappear when a system is shut down, overwritten, or rotated out of a log store.
Prioritize volatile and short-retention data
- System memory, which may contain running processes, encryption keys, injected code, network connections, and attacker tooling.
- Windows Security logs and other endpoint event logs that may be overwritten or cleared.
- Firewall and network-device log buffers that retain only a short history.
- Endpoint-protection, EDR, IDS, and IPS telemetry showing process execution, lateral movement, and command-and-control activity.
- Cloud audit records and volume state before automated retention or remediation changes the evidence.
CISA’s guide recommends system images and memory captures from a sample of affected devices when immediate mitigation is not required. Collect representative systems rather than attempting an unsafe, improvised forensic operation on every host. Preserve relevant logs, suspected malware samples, suspicious registry entries, and observables such as command-and-control addresses. If your team cannot collect this material safely, obtain qualified incident-response or digital-forensics assistance.
Use snapshots for cloud resources
For cloud systems, take volume snapshots for later forensic review before rebuilding or altering the workload, provided the snapshot process does not preserve an active attacker path. Record the account, region, resource identifier, timestamp, and the person who initiated the snapshot. Apply containment to identities and network access separately; a snapshot alone does not stop an intruder from using a still-valid credential.
Rank #2
- Screen Cleaner is Your Screen’s New Bestfriend! - EVEO is proud to present a screen cleaner that’s perfectly suited for your TV. Meet your new screen cleaner, computer screen cleaner, laptop cleaner, iPad cleaner, Macbook,tv cleaner or any other electronic device. Our screen cleaner spray and wipe along with the included plush microfiber cloth, easily removes dust, fingerprints & other smudges on the screen’s surface. Clean effectively for a streak-free screen
- Gentle on your Screens - Our screen cleaner spray and wipes is compatible to be used even for the most sensitive LCD, LED, CRT, and OLED screens in proper use. Be at ease knowing that this product is compatible with all the major brands: LG, SONY, Samsung, Sharp, iPad, iPhone, Android screens, Kindle, PC monitors - we’ve got you covered! Can be used as LCD screen cleaner, tv cleaner, smart tv screen cleaner, and more
- Premium Super Soft Plush Microfiber Cloth - Included in this efficient screen cleaning kit. This screen cleaner spray and wipe has our signature plush microfiber cloth specially designed to comply with screens and monitors and leave them streak-free. Has been shown to effectively absorbs stubborn stains, zero streaks, and no fiber shedding. Always use this together with our screen cleaner for the best results
- Easy-to-Use Screen Cleaner Kit + microfiber cleaning cloth - The EVEO Screen Cleaning Kit will easily be your new favorite tool when it comes to taking care of the things you love most, quick and easy solution for a streak-free screen. Simply screw on the sprayer gun on the screen cleaner bottle. Spray the cleaning liquid onto the microfiber cloth, then wipe the screen until desired cleanliness & shine is achieved.
- Quality Screen Care Kit Worth Purchasing - Enjoy a convenient Screen Cleaner anytime, anywhere you need it. Your satisfaction is our top priority. We stand behind the quality of our products and that’s why, you shouldn’t be worrying at all. We manufacture the Best Screen Cleaner. and can be used for laptop cleaning kit, laptop screen cleaner, tv screen cleaner for smart tv. MacBook screen cleaner, monitor cleaner or screen cleaner spray for electronic devices with microfiber cleaning cloth
Keep an evidence record
For every collection or change, record the time in a consistent time zone, the system or account involved, the action taken, the operator, and where the resulting image, log export, or sample is stored. Preserve original exports as read-only copies and perform analysis on working copies. This record helps investigators reconstruct the intrusion and helps counsel, insurers, regulators, and law enforcement evaluate what occurred.
Investigate scope, not just encrypted files
Visible encryption is often a late stage of a longer compromise. A ransom note may identify only the systems the attacker chose to encrypt, not the systems they accessed, copied data from, or prepared for a later action.
Search for the intrusion’s earlier stages
Review endpoint-protection and network-security data for the first suspicious authentication, malware execution, privilege change, remote-management session, or unusual outbound connection. Look for precursor malware, persistence mechanisms, and evidence that an earlier compromise was never resolved. Compare detections across endpoints and servers rather than investigating the ransom-note hosts in isolation.
- Identify the initial access vector, if it can be established, and the earliest trustworthy indicator.
- Map administrative shares, remote-management tools, scheduled tasks, services, and scripts used between systems.
- Search for suspicious registry entries, newly created accounts, altered security controls, and unusual process trees.
- Review suspected command-and-control destinations and related DNS, proxy, firewall, and VPN records.
- Determine whether data was staged, compressed, copied, or transferred before encryption.
Check identities and access paths
Inventory every account and service principal that touched an affected system, including privileged accounts, email accounts, backup identities, cloud roles, and automation credentials. Disable or rotate credentials only after preserving the evidence needed to understand their use, unless an account is actively being abused and immediate suspension is necessary.
Assess whether the findings require containment of remote access, VPN, single sign-on, email, public-facing applications, remote desktop, or other exposed services. CISA’s guidance emphasizes identifying involved systems and accounts and disabling related access paths when the investigation justifies it. Do not reset only the account named in a ransom note; determine which credentials and trust relationships the attacker could use.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Define the affected population
Create a working inventory with at least the hostname or cloud resource, owner, business function, operating status, observed indicators, last known clean time, evidence collected, and containment state. Mark uncertainty explicitly. A system with no ransom note is not automatically clean, and a system that appears encrypted is not necessarily the only compromised asset.
Rank #3
- 【Large size】：Measuring 800 x 300 mm/ 31. 5×12 inches, which is wider and taller than others. Large mouse pad can perfectly fit your keyboard and mouse of any size, and there is also ample space for peripherals such as phones, tablets, etc.
- 【LED backlight mouse pad】：Blade Hawks RGB mouse pad provides 7 static modes and 7 dynamic modes will give you the options you are looking for. Power-off memory function remembers the last lighting mode you selected. The super glow fiber Chroma will give you a colorful gaming setup that you want.
- 【Anti-slip rubber base】：Made from Natural rubber, this gaming mousepad will firmly grip your desktop, allowing you to enjoy the ultimate precision in the games you are most passionate about. It also comes with a texture that enhances this ability even further.
- 【Smooth and waterproof surface】: Micro-textured cloth surface, for extremely precise mouse control and a smooth movement. When liquid splashes on the gaming mouse pad, it forms water droplets and slides down. Will not delay your work or gameplay.
- 【Plug and play】: This mouse and keyboard pad is powered by USB, plug and play, no driver required. One button control light modes. Press one time to change the lighting mode, press twice to change the brightness, press and hold about 3 seconds turn ON/OFF.
Report the incident and coordinate decisions
Use established government and response channels
Follow your communications plan and keep leadership informed through the incident lead. In the United States, CISA lists several reporting or assistance routes: CISA itself, a local FBI field office, the FBI’s Internet Crime Complaint Center (IC3), and a local U.S. Secret Service field office. The FBI ransomware guidance directs victims to a local field office or IC3 and asks organizations to report whether or not they pay.
Coordinate with your managed-service providers, cloud providers, cyber insurer, outside counsel, and any retained incident-response or forensic firm. Preserve provider tickets, emergency authorizations, and containment recommendations as part of the incident record. CISA’s data-breach fact sheet advises considering a reputable provider experienced in data breaches when internal capability is insufficient.
Determine notification duties with counsel
If personal information, health information, payment data, regulated records, or confidential customer material may have been accessed, ask counsel to determine notification and reporting obligations. Requirements depend on the affected people’s jurisdictions, the organization’s sector, contracts, the type of data, and the facts established during the investigation. State breach-notification laws and special rules for some health information may apply, but there is no single deadline that can be stated safely for every organization.
Preserve the evidence and timeline that counsel needs to assess whether data was merely encrypted, viewed, exfiltrated, or destroyed. Do not announce an unverified attribution, scope, or data-loss conclusion simply to meet pressure for a quick public statement.
Coordinate communications deliberately
Use one approved source of truth for internal status, customer notices, regulator submissions, and public statements. Separate confirmed facts from working hypotheses. Tell employees how to report symptoms, where to obtain approved updates, and which systems must not be used until cleared. Avoid publishing technical indicators or recovery details that could help an active attacker unless the response team and counsel approve them.
Contain and eradicate the compromise
Apply guidance for the confirmed ransomware variant
Once the response team has reliable indicators, use current, trusted guidance for that ransomware family and your environment. Remove known ransomware binaries and related artifacts, close the exploited access path, eliminate persistence, and address every compromised account and system. Do not assume that deleting the ransom note or running a single malware scan removes an attacker who had administrative access.
Rank #4
- 【Softer and More Comfortable】Vaydeer wrist rest has unique diamond pattern, which is the combination of softness and aesthetics. The materials of wrist rest are improved into higher quality memory foam and covered with silky smooth lycra. The computer wrist rest makes you as comfortable and cushiony as like rest your wrists on clouds.
- 【Ergonomic Wrist Saver】The wrist rests for keyboard and mouse comes with a 17.32×3.15×0.83 inch keyboard wrist pad and a 5.94×3.15×0.83 inch mouse wrist support. Based on ergonomic design, the unique concave shape is the perfect fit for your wrist joints. The wrist rest pad fits most computer keyboards and laptops, improve hand and wrist posture, release your wrist and arm stress.
- 【Non-Slip Rubber Bottom】Featuring an anti-skid silicone base on the bottom, this wrist keyboard support stays firmly in place on your desk, preventing the padding from sliding around, ensuring stable and consistent wrist support during extended computer sessions.
- 【Better Experience & Pain Relief】Our keyboard arm rest is beneficial to alleviate the soreness caused by direct contact and friction between your arm and a hard desk surface, reducing the risk of wrist fatigue or carpal tunnel. The soft texture of memory foam can evenly distribute the pressure around your wrists and provide good support with just enough give.
- 【Helpful in Multiple Scenarios】Whether you're working, studying, writing, typing, gaming, this keyboard and mouse rest combo is an essential accessory to add comfort and support to your hands and wrists. It’s also a great gift for men, women, family, friend, coworker, gamer, teacher, etc.
Keep containment in place while eradication is validated. Reimage or rebuild systems when their integrity cannot be established, especially for privileged infrastructure. Preserve forensic copies before destructive remediation when operationally possible and safe.
Ask law enforcement about decryptors, but do not depend on one
Law enforcement may know of variant-specific decryptors or related intelligence. Ask through the reporting channels, but do not assume that a decryptor exists, works for your variant, or restores damaged files. Test any recovery method on copies and have qualified responders verify that it does not introduce additional malware.
Recheck persistence after remediation
Before declaring eradication, search again for unauthorized accounts, scheduled tasks, services, remote-management tools, altered security policies, suspicious mailbox rules, cloud access keys, and unexplained outbound connections. Confirm that monitoring and logging are functioning and that security controls were not merely disabled by the attacker and then re-enabled without correcting the underlying access.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Restore services only into a clean environment
Set recovery priorities by business dependency
List critical services, their dependencies, recovery order, acceptable data loss, and the people authorized to approve restoration. A domain service, identity provider, network service, backup system, or manufacturing control may need to be restored before the application that depends on it. Do not let the loudest business request determine the order without considering trust relationships and security prerequisites.
Use offline, encrypted backups
CISA recommends restoring from offline, encrypted backups according to critical-service priorities. Select restore points that predate the compromise and verify that the backup infrastructure itself was not altered. Keep backup administration isolated from ordinary production credentials, and scan or inspect restored systems before they are connected to production.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →Build and protect the recovery network
Use a clean recovery network with restricted administration, monitored traffic, and only the services required for restoration. Do not add a compromised system to that network merely because its files have been restored. Rebuild or reimage when necessary, apply security updates and hardened configurations, rotate affected credentials, and validate identity and logging controls before opening communication paths.
Best Value
- 【No Drill Mounted】Cable management tray can be assembled in as little as 3 minutes or less-simply. Side clips easily clampe the edge of desk, pass through the holes on the sides, and secure excess cables with baskets. Desk cable management supports inward or outward installation to meet your needs in different scenarios, and provides you with great convenience when collecting and organizing wires.
- 【Rubber Pad Protects Desk】Wire organizer under desk built-in soft rubber pads on the clamp protect your desk from scratches, so you will not damage your furniture or office.
- 【Sturdy and Beautiful】Cord management under desk is made of high-quality carbon steel and holds about 15 lbs. The wire basket has 2 holes on each side of the tray to enable your cables to pass freely. Cable baskets are suitable for desk thickness use from 0.4" to 2.4".
- 【Space Saving & Keep Organized】Desk cable management tray holds all your power cords, outlet strips, USB hubs and computer transformers hidden from your feet, and the data cables will not enter the vacuum cleaner to keep your desk clean and tidy. Desk wire organizer is also suitable for use in the kitchen and outdoors.
- 【Reduce Safety Risks】Cable tray under desk keeps all plugs away from your kids, no more worry about tripping. Using 2 holes wire tray saves extra space, helps you easily cabling and wire protection. The mesh design is not easy to accumulate dust, but avoids safety accidents caused by messy wires.
Validate before reconnecting
- Confirm that the system’s source image or rebuild process is trusted and that the selected backup predates the intrusion.
- Check endpoint protection, logging, time synchronization, administrative accounts, scheduled tasks, services, and network connections.
- Verify that required credentials have been rotated and that unnecessary remote access is disabled.
- Test the application and its dependencies in the recovery network while monitoring for suspicious behavior.
- Obtain the incident lead’s approval before reconnecting the system to production, and record the evidence supporting that approval.
Document lessons after service returns
When critical services are stable, conduct a structured lessons-learned review. Record the initial access, detection gaps, containment decisions, evidence that was lost, recovery dependencies, communication problems, and controls that must change. Update the incident-response plan, backup design, identity controls, logging retention, segmentation, and exercises. NIST’s ransomware publications index lists Incident Response Recommendations and Considerations for Cybersecurity Risk Management: A CSF 2.0 Community Profile (NIST SP 800-61 Rev. 3) as final on April 3, 2025; use the current publication when updating your broader response program.
Should an organization pay the ransom?
CISA, the FBI, and the NSA discourage ransom payment. Their stated concerns include encouraging further criminal activity and the fact that payment does not guarantee data recovery or prevent additional harm. The FBI says it does not support paying and asks victims to report the incident whether or not they pay; see the joint CISA/FBI/NSA advisory for the agencies’ payment guidance.
Payment is not a substitute for containment, evidence preservation, notification analysis, eradication, or clean restoration. If leadership is considering it, treat the decision as a high-consequence legal, operational, insurance, sanctions, and law-enforcement matter. Involve counsel, the insurer, the incident lead, and appropriate authorities; verify the identity and restrictions applicable to the recipient; and understand that criminals may fail to provide a working key, may retain copied data, or may attack again.
Practical command-center checklists
Incident lead checklist
- Incident declared and decision authority recorded.
- Affected hosts, subnets, cloud resources, accounts, and business services inventoried.
- Isolation coordinated through an out-of-band channel where feasible.
- Memory, security logs, firewall buffers, endpoint telemetry, and cloud snapshots preserved when safe.
- Potentially affected remote access, VPN, SSO, email, public services, and privileged identities assessed.
- Counsel, insurer, service providers, leadership, and relevant business owners engaged.
- CISA, FBI field office, IC3, or Secret Service reporting considered for a U.S. incident.
- Notification obligations evaluated for every relevant jurisdiction and data type.
- Recovery network, backup integrity, restoration order, and reconnection approvals defined.
Evidence handoff checklist
- System or resource identifier and owner.
- Collection time zone and precise timestamp.
- Person and tool that collected the item.
- Original location and read-only storage location.
- Associated indicators, account, network path, and suspected time window.
- Hash or other integrity record where your forensic process supports it.
- Known limitations, missing logs, powered-off devices, or actions that may have changed evidence.
Where this guidance applies
The response sequence is written for organizational environments and uses U.S. federal sources as its baseline. CISA’s guide is identified as the September 2023 edition, while CISA’s overview describes an update in May 2023; consult the live CISA ransomware information page for revisions. U.S. reporting contacts and legal references do not automatically apply elsewhere. Organizations outside the United States should use their national cyber authority, applicable law-enforcement channels, local breach rules, contracts, and sector requirements.
No tool, backup, decryptor, restoration method, or outside provider guarantees recovery. The safest outcome comes from coordinated containment, defensible evidence handling, complete scope analysis, lawful reporting, eradication, and a carefully validated return to service.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
