PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteiTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Contain the attack before trying to recover files. Disconnect infected devices, isolate critical network segments, move coordination to a clean connection, and call your established IT provider or a reputable incident-response specialist. Then document the incident, assess whether personal data was affected, meet any ICO reporting duty, and restore only into a verified clean environment.
Do not assume that paying a ransom will restore operations, that an antivirus scan proves eradication, or that an NCSC report replaces regulator or legal notifications. The sequence below is designed for UK business owners, directors, IT leads and staff managing an active incident.
1. Contain the attack immediately
Ransomware can continue to spread while people investigate it. The first objective is to stop communication between infected systems and the rest of the environment.
Recommended Free Tools
- Disconnect affected devices. Unplug wired network cables and disable Wi-Fi, Bluetooth and mobile-data connections on infected or suspicious laptops, desktops, servers and virtual machines. Do not simply shut down a machine if doing so could destroy useful volatile evidence; ask your incident lead or specialist first when evidence preservation is important.
- Isolate the wider network if spread is severe. If multiple systems are encrypting files, domain controllers or shared storage are affected, or you cannot identify the boundary of the infection, consider disabling core network connections or internet access. The NCSC’s ransomware response guidance describes this as a necessary containment step in serious cases: NCSC ransomware attack response and recovery guidance.
- Use a clean device and separate connection. Coordinate by phone or from a device known to be unaffected, using a separate internet connection where possible. Do not submit reports or reset passwords through a network you believe is compromised.
- Escalate to the incident lead and IT support. Tell directors or the person with authority to make business-continuity decisions. Contact the external IT provider responsible for your environment, if you have one, and engage specialist incident response when the scope or expertise required exceeds your internal capability.
Changing every password immediately can be counterproductive if responders lose access to systems needed for recovery. Reset credentials—especially administrator credentials—through a controlled plan that checks recovery access, service accounts and emergency accounts first. Keep a record of each change.
#1 Best Overall
- Slim durable design to help take your important files with you
- Vast capacities up to 6TB[1] to store your photos, videos, music, important documents and more
- Back up smarter with included device management software[2] with defense against ransomware
- Help secure your important files with password protection and hardware encryption
- 3-year limited warranty
For practical small-business actions, see the NCSC Small Business Guide: Resolve the incident.
2. Decide whether this is a major operational incident
Ask leadership to establish whether business-critical systems or services are unavailable, severely degraded, or likely to be affected. Examples include inaccessible finance or customer systems, halted production, unavailable clinical or safety functions, inability to process orders, or a large number of encrypted endpoints.
If important operations are impaired, treat the event as a disruptive cyber incident rather than an ordinary help-desk problem. The NCSC’s operational-impact triage guidance helps distinguish incidents requiring a coordinated response. Activate your continuity plan, assign one decision-maker, and set regular situation updates so staff do not improvise conflicting actions.
3. Bring in qualified help and keep an incident record
Choosing an IT or incident-response provider
Start with the provider that already understands your systems, contracts and backups. If you need a cyber-security consultant, check its reputation, relevant incident-response experience and how its proposed work fits your organisation’s requirements, as the NCSC advises. Ask practical questions before granting privileged access:
- Has the team handled environments like yours and incidents involving both encryption and possible data theft?
- How will it preserve evidence while containing the attack?
- What is the clean rebuild and restoration method, and who approves reconnection?
- What availability, escalation and out-of-hours arrangements are included?
- Which actions are covered by the engagement and which require separate approval?
A provider’s marketing claim is not proof of capability. Obtain names of the people who will perform the work, confirm insurance and confidentiality arrangements, and make sure the contract allows urgent containment and forensic work.
Rank #2
- Slim durable design to help take your important files with you
- Back up smarter with included device management software[2] with defense against ransomware
- Help secure your important files with password protection and hardware encryption
- 3-year limited warranty
Maintain a contemporaneous incident log
Use a clean, access-controlled document or notebook. Record:
- When the first symptoms were noticed and when the incident was declared.
- Systems, accounts, locations and services affected or suspected.
- Ransom notes, filenames, extension changes, alerts and screenshots.
- Every containment, credential, shutdown, rebuild and restoration action, with time and person responsible.
- Contacts, decisions, approvals, assumptions and facts that remain unconfirmed.
Preserve ransom notes, relevant logs and copies of suspicious emails or files without opening them unnecessarily. Your log supports technical recovery, insurance and legal decisions, and the later risk assessment required even when no regulator notification is made.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
4. Do not treat ransom payment as a recovery plan
The NCSC states: “The NCSC and UK law enforcement do not encourage, endorse or condone the payment of ransom demands.” Payment does not guarantee a working decryptor, complete data recovery, deletion of stolen copies or an end to attacker access. A system that decrypts may still contain persistence, compromised accounts or malware, so it requires investigation and remediation.
Directors should make any decision only after taking legal, sanctions, insurance and law-enforcement advice. Preserve communications and approvals. Do not let a ransom negotiation delay containment, evidence preservation, notification assessment or preparation of a clean rebuild.
5. Assess personal-data exposure promptly
Ransomware is not only an availability problem. The Information Commissioner’s Office (ICO) explains that loss of timely access to personal data can itself be a personal-data breach, even when theft has not been established. If attackers copied data, that may also involve unauthorised access or disclosure.
Rank #3
- No wall warts: Work freely with its bus-powered USB-C. No wall outlet required.
- Big on space: High-capacity storage to store all your files in one place.
- Reliable backup: Safeguard assignments, projects, or sensitive files with trusted performance.
- Fuss-free, clutter-free: One port, one cord, quick connect.
- Peace-of-mind: Comes with two-year limited warranty and Rescue Data Recovery Services.
Identify what personal data was stored on affected systems, whose data it was, whether it was encrypted or exfiltrated, and what harm could result. Consider customers, employees, suppliers, patients, children and other vulnerable people separately where the risks differ. Use available logs, endpoint evidence, cloud audit records and forensic findings, but do not wait for perfect certainty before assessing risk.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →When the ICO’s 72-hour clock applies
If the breach is likely to result in a risk to people’s rights and freedoms, notify the ICO without undue delay and, where practicable, within 72 hours after awareness. The ICO’s 2025 small-organisation guidance says the clock starts when the breach is discovered, not when the underlying attack began: 72 hours: responding to a personal data breach.
You can report with the information available and provide further details later. A notification normally needs the nature of the breach, categories and approximate numbers of people and records affected, likely consequences, and the measures taken or planned. Keep your risk assessment and a record of the incident even when the threshold for notification is not met. The ICO notes that this guidance is under review following the Data (Use and Access) Act 2025, so check the current regulator page before submitting.
6. Report through the right channels
Use the NCSC’s Cyber Incident Signposting Service when appropriate. This route does not discharge separate ICO, contractual, sector-regulator or other legal obligations. If the attack is live and affecting operations, the NCSC small-business guidance lists a 24/7 incident phone line: 0300 123 2040. Verify current contact details on the NCSC Response & Recovery guide before calling.
Do not use a suspected-compromised network to file an online report. Consider reporting to the police or other law-enforcement body when criminal intent is suspected, and check contracts, insurance policies and sector rules for additional notification deadlines. Keep the reference numbers and copies of all submissions in the incident log.
Rank #4
- High-capacity external hard drive with up to 2TB of storage The ModusTech Facet portable external hard drive gives you dependable HDD storage in a slim 2.5-inch design. Multiple capacities available up to 2TB — back up photos, videos, music, documents, and game libraries with room to grow. A trusted external storage solution for everyday backup, media archives, and creative work.
- USB-C and USB 3.1 connectivity with included 2-in-1 cable The Facet ships with a USB-C to USB-C cable and tethered USB-A adapter, so this external hard drive connects to modern laptops, USB-C iPhones, tablets, and older USB-A computers without buying an extra cable. USB 3.1 Gen 1 (5Gbps) interface delivers real-world transfer speeds up to 100MB/s — fast enough to back up 50GB of files in about 8 minutes.
- Plug-and-play external hard drive for PC, Mac, and laptops Preformatted in exFAT and ready to use the moment you plug it in. The Facet works out of the box with Windows PCs, macOS Macs, MacBooks, Chromebooks, and laptops — no drivers, no software, no setup required. A true plug-and-play external hard drive built for everyday use across every major operating system.
- External hard drive for PS4, Xbox One, and Smart TV gaming The Facet is compatible with PlayStation 4, Xbox One, and Smart TVs with USB support. PS4 and Xbox One games run directly from the drive — plug it in, format through the console, and add to your storage. Also works with Smart TVs that support USB recording or external media playback.
- Slim, shock-resistant portable external hard drive — 160g At 2.5 inches and just 160g, this portable external hard drive is bus-powered through a single USB-C cable — no separate power adapter, no extra cables. Slim enough for a laptop bag, jacket pocket, or camera bag, with a shockresistant casing and faceted diamond-texture top panel that resists fingerprints and everyday wear. Backed by a 1-year limited warranty from ModusTech, a consumer electronics brand specializing in external storage.
7. Rebuild and restore only in a clean environment
A successful file copy is not proof that attackers have been removed. Follow a controlled rebuild sequence with your IT or incident-response team.
- Identify the recovery boundary. Determine which endpoints, servers, identity systems, cloud workloads, backup repositories and network devices may have been exposed. Treat credentials and management tools used by an infected system as potentially compromised until checked.
- Protect and examine backups. Keep backup media or repositories isolated while they are checked for ransomware, tampering and a usable restore point. Verify both the backup and the destination system are clean before restoration.
- Wipe affected devices. Safely erase infected endpoints and servers rather than trusting an in-place cleanup. Reinstall the operating system from trusted media and apply secure baseline settings.
- Update through a clean network. Download operating-system and application updates from trusted sources using a clean connection. Apply security fixes before reconnecting the rebuilt device to production.
- Scan and validate. Run current antivirus and endpoint checks, review logs and confirm that administrator accounts, remote-access tools, scheduled tasks and firewall rules are expected.
- Restore in stages. Start with identity, network and the services needed to support recovery, then restore business data in an agreed priority order. Keep rebuilt systems segmented until they pass checks.
- Reconnect and monitor. Reintroduce systems gradually. Watch authentication, DNS, outbound traffic, file changes and endpoint alerts for signs of continued infection or unauthorised access.
The NCSC’s detailed recovery guidance is available at Ransomware attack: response and recovery. Do not declare the incident over merely because files open again; obtain documented approval from the incident lead after monitoring and investigation.
8. Build backups that can survive the next attack
In its March 2026 guidance, the NCSC calls up-to-date backups “the most effective way of recovering from a ransomware attack.” A resilient design has more than one copy and assumes that attackers may reach ordinary backup software or connected storage.
| Backup practice | What to implement | Why it matters |
|---|---|---|
| Isolation | Keep at least one copy offline or otherwise separate from the live network. Disconnect external drives and USB devices when they are not actively being used for backup or restore. | Limits an attacker’s ability to encrypt or delete every copy. |
| Different locations and solutions | Use multiple copies in different locations and, where practical, different backup technologies or services. | A single compromised account, appliance or site is less likely to destroy all recovery points. |
| Restore testing | Schedule test restores, record what was restored and how long it took, and correct failures. | A backup that has never been restored is an assumption, not evidence of recoverability. |
| Operational fit | Set recovery priorities and acceptable downtime for each critical service, then test against those needs. | The appropriate recovery time depends on your business; the cited NCSC guidance does not prescribe one universal target. |
An external hard drive can be one offline copy, but it must be disconnected when not backing up and must never be the sole copy. Protect backup administration with separate credentials and multi-factor authentication where supported, and monitor deletion or retention-policy changes.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Clear out junk files and repair common Windows errors3Fix the driver behind crashes, sound loss and screen glitchesQuick Recap
9. Common mistakes that prolong damage
- Continuing to work on the infected network: this can spread encryption and expose reporting credentials.
- Restoring immediately from the newest backup: the newest copy may contain malware or attacker changes; verify it first.
- Assuming no exfiltration means no data breach: loss of timely access alone can meet the ICO’s breach definition.
- Waiting 72 hours to start the assessment: 72 hours is a notification limit where the legal threshold is met, not a period to delay investigation.
- Resetting credentials without a recovery plan: responders can lock themselves out of essential systems or service accounts.
- Relying on one antivirus scan: scanning is one check within eradication and monitoring, not proof that attacker access has ended.
- Assuming an NCSC report covers every duty: regulator, contractual, insurance and sector notifications remain separate.
10. A practical leadership checklist
- Contain affected devices and, if necessary, core network or internet connections.
- Move coordination and reporting to a clean device and separate connection.
- Declare the appropriate incident level and assign one decision-maker.
- Contact your established IT provider or a reputable specialist with relevant experience.
- Start and preserve the incident log, evidence and decision records.
- Assess personal-data involvement and likely risk immediately.
- Notify the ICO within 72 hours when the legal threshold is met, adding information later if needed.
- Use NCSC reporting, law-enforcement and sector channels as appropriate, without treating one as a substitute for another.
- Verify backups, rebuild affected systems, restore in stages and monitor after reconnection.
- After recovery, test isolated backups, review access controls and update the incident-response plan.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
