Recommended Free Tools
iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Contain the attack before trying to fix anything. Activate your incident-response plan, isolate affected systems in a coordinated way, and switch to phone or other out-of-band communications. Do not routinely shut computers down: power off a device only when you cannot disconnect it from the network, because shutdown can erase volatile evidence. Then preserve evidence, notify the right internal and external responders, assess data exposure, and recover only from clean, offline backups.
What should you do in the first 15 minutes?
Use a preassigned incident leader if your business has one. If not, an executive should name a single coordinator immediately and keep a written event log with timestamps, decisions, people contacted, and systems affected. The first operational objective is containment, not ransom negotiation, malware deletion, or restoring files.
- Declare an incident and activate the response plan. Bring in IT or security, management, communications, legal counsel, cyber-insurance contacts, and managed security providers specified in your plan.
- Identify the visible scope. Note which computers, servers, virtual machines, cloud tenants, user accounts, locations, and network segments show encryption, ransom notes, unusual logins, or unavailable services. Treat the list as provisional; an attacker may already have moved elsewhere.
- Isolate affected systems in a coordinated sequence. Keep a record of every device or segment disconnected and by whom.
- Move sensitive coordination off potentially monitored channels. Use phone calls or another out-of-band method rather than discussing containment in email, chat, or systems that may be compromised.
The joint CISA, FBI, NSA, and MS-ISAC #StopRansomware Guide says, “Be sure to move through the first three steps in sequence.” Its September 2023 guide is listed by CISA with a revision date of October 19, 2023; verify that a newer edition and current contact routes are available when an incident occurs.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →How do you contain the spread?
Disconnect individual devices when the incident is limited
Remove affected computers and servers from Ethernet and Wi-Fi, or use network-access controls to block them. Disable active network interfaces only after recording the device name, address, logged-in user, and time. Do not reconnect a machine merely to check whether it is safe. If an endpoint is remote, coordinate with the user by phone and use your remote-management platform only if you trust it has not been compromised.
#1 Best Overall
- Read Before You Buy — No Video Output: These adapters support charging and USB 2.0 data transfer, but cannot transmit video signals. Except for standard USB webcams (which use USB data only), they are not compatible with HDMI/DisplayPort cables, video-capable USB-C hubs, or docking stations with video output.
- Convert USB-A Ports to USB-C: Designed to connect USB-C earphones, cables, flash drives, card readers, and other USB-C accessories to standard USB-A ports. Plug-and-play with no drivers or software required.
- Aluminum Alloy Housing: Built with a sturdy aluminum alloy shell that aids in heat dissipation and protects against daily wear and scratches. Designed to maintain a stable and secure connection.
- Compact & Travel-Friendly: The ultra-compact design allows the adapter to stay plugged into your device without blocking adjacent ports or adding bulk, reducing wear and tear on your original USB ports.
- 12-Month Warranty: Backed by a 12-month manufacturer warranty for peace of mind. Designed to meet strict quality control standards for reliable everyday performance.
Take a wider segment offline when several systems are involved
If multiple hosts or subnets appear compromised, individual disconnections may leave an attacker a path to move laterally. CISA notes that taking the network offline at the switch level may be necessary. Have the network lead isolate the smallest segment that contains the spread while preserving essential safety, production, and emergency services. Record which switches, VLANs, VPN concentrators, wireless controllers, and internet links were disabled so they can be restored deliberately.
Use coordinated action and out-of-band communication
Uncoordinated shutdowns can destroy evidence, interrupt backups, or cause staff to reconnect systems while another team is containing them. CISA advises isolating systems in a coordinated manner and using phone calls to avoid tipping off actors that they have been discovered. Assume that compromised email, collaboration tools, identity systems, and file shares may be monitored until your responders establish otherwise.
| Situation | Preferred first action | Main risk to manage |
|---|---|---|
| One or a few clearly affected endpoints | Disconnect each from Ethernet and Wi-Fi; block them at network controls if possible. | An apparently unaffected host may also be compromised. |
| Several hosts, servers, or subnets showing signs | Coordinate broader isolation, potentially taking the relevant switch or segment offline. | Operational outage and loss of visibility if changes are not logged. |
| A device cannot be disconnected by network controls or physically | Consider powering it down only as a fallback. | Volatile memory and other live evidence may be lost. |
Should you turn off the computer?
Only when you cannot isolate it by another practical means. A powered-on system may contain memory-resident malware, encryption keys, running processes, and network connections that are valuable to investigators. CISA cautions that shutdown can destroy evidence in volatile memory. If you can disconnect the machine from every network without powering it off, do that first and leave it in its current state for qualified responders.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Rank #2
- 5-in-1 USB-C Hub: Experience comprehensive connectivity featuring a Power Delivery input, two USB-A 2.0 ports, a USB-A 3.0 port, and an HDMI port. (Note: The USB-C power delivery input port is only for connecting an external wall charger to power your laptop and cannot power peripheral devices.)
- 90W Pass-Through Charging: Achieve optimal charging with 90W pass-through power to your laptop, supported by a total input of 100W, with the hub reserving 10W for operational efficiency. (Note: Wall charger not included.)
- Quick Data Transfers: Accelerate your productivity with rapid data transfers using a high-speed 5Gbps USB 3.0 port and two 480Mbps USB 2.0 ports.
- 4K HDMI Display: Enhance your visual experience with a hub capable of delivering 4K resolution at 30Hz in both mirror and extend modes. Please note that this hub is compatible with MacBook (macOS 12 and newer), Windows 10 and 11, ChromeOS, and laptops equipped with DP Alt Mode and Power Delivery. Note: This device is not compatible with Linux.
- What You Get: Anker USB-C Hub (5-in-1, 4K HDMI), welcome guide, 18-month warranty, and our friendly customer service.
Power down when leaving the system connected would allow continuing spread and temporary network isolation or physical disconnection is unavailable. Before doing so, note the screen, ransom note, time, logged-in account, cables, and any visible error. Photograph the display if your policy permits. Do not repeatedly reboot, run cleanup utilities, delete ransom notes, or browse through encrypted directories; each action can alter evidence.
What evidence should you preserve?
After containment, triage systems by business criticality and evidentiary value. If immediate mitigation is not possible, CISA recommends taking a system image and memory capture from a sample of affected devices, collecting relevant logs and malware samples, and preserving volatile evidence such as system memory and short-retention security or firewall logs.
Preserve a representative sample
- Capture disk images and live memory from selected endpoints and servers before rebuilding them.
- Export endpoint-detection, authentication, VPN, firewall, DNS, cloud, backup, and privileged-access logs in a format that preserves timestamps and source information.
- Save ransom notes, suspicious files, scripts, email messages, and indicators of compromise without opening or modifying the originals.
- Record hostname, IP address, operating system, user, physical location, time discovered, and containment action for every sampled system.
Protect the chain of custody
Store copies in a restricted location that the attacker cannot alter. Keep originals read-only where feasible, hash collected files according to your forensic procedure, and document who handled each item. Do not improvise forensic techniques on production systems. Engage qualified incident responders or digital-forensics specialists when your staff lacks the tools or experience to capture memory and images safely.
Rank #3
- Sleek 7-in-1 USB-C Hub: Features an HDMI port, two USB-A 3.0 ports, and a USB-C data port, each providing 5Gbps transfer speeds. It also includes a USB-C PD input port for charging up to 100W and dual SD and TF card slots, all in a compact design.
- Flawless 4K@60Hz Video with HDMI: Delivers exceptional clarity and smoothness with its 4K@60Hz HDMI port, making it ideal for high-definition presentations and entertainment. (Note: Only the HDMI port supports video projection; the USB-C port is for data transfer only.)
- Double Up on Efficiency: The two USB-A 3.0 ports and a USB-C port support a fast 5Gbps data rate, significantly boosting your transfer speeds and improving productivity.
- Fast and Reliable 85W Charging: Offers high-capacity, speedy charging for laptops up to 85W, so you spend less time tethered to an outlet and more time being productive.
- What You Get: Anker USB-C Hub (7-in-1), welcome guide, 18-month warranty, and our friendly customer service.
Who should be notified?
Internal and contracted teams
Follow the call tree in your incident-response and communications plans. Notify the executive incident owner, IT/security, system and backup administrators, legal counsel, communications staff, cyber-insurance carrier, managed security provider, and critical suppliers as applicable. Tell employees what to do through a channel you trust: do not reconnect devices, reset passwords from a potentially infected computer, or forward ransom notes through compromised email.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →U.S. assistance and reporting
CISA says organizations should report and consider requesting assistance from CISA, their local FBI field office, the FBI Internet Crime Complaint Center (IC3), or a local U.S. Secret Service field office. The guide lists report.cisa.gov and 1-844-Say-CISA (1-844-729-2472). These references are U.S.-focused and may change, so confirm current routes on official sites and through your insurer or counsel. Reporting early can help investigators connect related incidents and may affect available technical assistance.
How do you determine what is affected?
Build a live scope matrix rather than relying on the ransom note. For each system or service, record whether it is isolated, encrypted, unavailable, suspected compromised, or verified clean; what data it stores; its business owner; and its restoration dependency. Prioritize life-safety functions, identity services, communications, production systems, customer-facing services, and the systems needed to restore other systems.
Rank #4
- Dual Converters, Infinite Potential：Includes 2× USB C male to USB A female adapters and 2× USB A male to USB C female adapters. Perfect for a wide range of uses—tablets with Bluetooth keyboards, expand USB ports on macbook, and more. Two different converters for all your daily needs
- Next-Level 10Gbps & 3A Charging: No more slow 480Mbps, this usb to usb c adapter has a transfer speed of up to 10Gbps, allowing you to do more transferring in less time. This usb adapter fits both USB A and USB C charger, supporting up to 3A fast charging
- Upgraded Exquisite Craftsmanship: With an aluminum alloy housing and metal connector, the usbc to usb adapter is extremely durable and sturdy. Rigorously tested to withstand more than 10,000 times of plugging and unplugging, ensuring long-lasting performance
- Broad Compatible: The usb c to usb adapter widely supports all USB C/ USB A devices like laptops, tablets, cellphones, car chargers, and phone chargers. Such as compatible with MacBook Pro/Air 2023/2022, Thunderbolt 4/3 Devices,Apple MagSafe Watch 9/8/7/SE/Ultra, iPad Pro 2022/2021, Samsung Galaxy S23/S20/S10, and iPhone 17/16/15 Pro. Plug and play
- Please Note: To reach 10Gbps speed, keep the cable under 3.3 ft. For USB A Male to USB C adapters, try flipping the USB C connector. USB C Male to USB A adapters support bidirectional 10Gbps transfer within 3.3 ft
Check for signs of credential theft and lateral movement, including unexpected privileged accounts, altered group membership, disabled security tools, unusual remote-access sessions, and backup-console activity. Preserve facts even when you cannot yet prove exfiltration. A ransom demand or encryption event alone does not establish exactly what data was accessed.
What if personal or business data may have been stolen?
Preserve evidence about possible access or exfiltration: affected repositories, account activity, outbound connections, file names, timestamps, and the period during which the attacker had access. Ask legal counsel to map those facts to the jurisdictions, contract commitments, sector rules, and types of personal information involved. CISA directs organizations with a breach to follow notification requirements in their incident-response and communications plans; the correct deadline and recipients depend on the facts and applicable law. Do not announce that no data was taken merely because you found encrypted files, and do not announce a breach before your legal and communications teams have validated the facts.
Free tools Windows power users keep installed
One-click scans. No signup required.
How should recovery begin?
Set restoration priorities
Approve a recovery order based on business criticality, dependencies, available clean images, and the risk of reinfection. Establish a controlled recovery environment with fresh administrative credentials, patched systems, monitored network access, and logging before reconnecting production devices.
Best Value
- 5-in-1 Connectivity: Equipped with a 4K HDMI port, a 5 Gbps USB-C data port, two 5 Gbps USB-A ports, and a USB C 100W PD-IN port. Note: The USB C 100W PD-IN port supports only charging and does not support data transfer devices such as headphones or speakers.
- Powerful Pass-Through Charging: Supports up to 85W pass-through charging so you can power up your laptop while you use the hub. Note: Pass-through charging requires a charger (not included). Note: To achieve full power for iPad, we recommend using a 45W wall charger.
- Transfer Files in Seconds: Move files to and from your laptop at speeds of up to 5 Gbps via the USB-C and USB-A data ports. Note: The USB C 5Gbps Data port does not support video output.
- HD Display: Connect to the HDMI port to stream or mirror content to an external monitor in resolutions of up to 4K@30Hz. Note: The USB-C ports do not support video output.
- What You Get: Anker 332 USB-C Hub (5-in-1), welcome guide, our worry-free 18-month warranty, and friendly customer service.
Use clean, offline, encrypted backups
Restore from backups that were offline or otherwise inaccessible to the attacker and encrypted at rest. Ransomware can find, encrypt, or delete backups that remain reachable. Verify backup integrity and the restore date, scan restored systems, and compare configurations with known-good baselines. Restore a small, noncritical sample first when feasible, then test applications and data before expanding.
Reconnect in stages
- Rebuild or reimage systems rather than trusting a machine that was merely decrypted.
- Reset compromised credentials, beginning with privileged, service, VPN, and backup accounts; use a trusted administrative workstation.
- Restore core identity, security monitoring, and management services needed to supervise recovery.
- Reconnect one dependency group at a time while watching endpoint, authentication, network, and backup telemetry.
- Stop and re-isolate if encryption, suspicious accounts, or unauthorized traffic reappears.
Ask law enforcement or qualified responders whether a decryptor is available for the specific strain. Do not assume a decryptor exists, that it will work on every file, or that payment guarantees recovery. The cited CISA checklist does not establish a universal ransom-payment rule; treat any payment decision as a legal, sanctions, insurance, operational, and risk-management matter requiring specialist advice.
What should you avoid during the first day?
- Do not let each department make independent containment changes.
- Do not negotiate, pay, or promise a payment before involving legal counsel, insurers, and qualified responders.
- Do not wipe every affected machine before collecting a representative forensic sample.
- Do not reconnect restored systems directly to an unexamined network.
- Do not rely on accessible online backups as proof that recovery is safe.
- Do not use compromised email or chat to discuss investigative findings or credentials.
A practical first-day checklist
- Incident leader named; event log opened; phone bridge or other trusted channel established.
- Affected hosts and segments identified and isolated in a recorded sequence.
- Power-down decisions documented, with evidence-preservation considerations.
- Critical systems, data owners, dependencies, and backup locations mapped.
- Memory, disk images, logs, ransom notes, and malware samples preserved from a representative sample.
- IT/security, executives, legal, communications, insurer, and specialist responders engaged.
- U.S. reporting and assistance options evaluated through current official contacts.
- Potential data exposure assessed without making unsupported conclusions.
- Clean restoration environment and offline, encrypted backup set selected and tested.
- Recovery sequence approved, monitored, and ready to stop if reinfection appears.
What to improve after containment
When operations stabilize, turn the incident record into specific corrective work: test that offline backups can be restored, restrict backup and administrative access, define switch-level isolation authority, maintain an out-of-band contact list, and rehearse the call tree. CISA recommends offline, encrypted backups of critical data and regular testing of their availability and integrity. Document which evidence was preserved, which systems were rebuilt, what accounts were reset, and which legal or contractual notifications were made so that lessons become durable controls rather than informal memory.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
