Don’t panic and do this:

Remove the infected device from the network by removing the network cable, or if it is a wireless connection, disconnect from all wireless networks, turn the wireless off, and maybe even shut the machine down. If you are in an office with multiple devices and you uncertain where the infection started, remove all devices from the network including file servers, NAS’s etc.

DO NOT download and run any virus detectors/cleaners, this could actually damage the machine further and make files unrecoverable.

The removal of the threat and recovery of the data should be left to professionals, call your trusted IT specialist who can advise on the process. Data should not be recovered until the threat is eliminated.

In rare cases the decrypter is available for the specific ransomware and files can be decrypted.

Danny Martin IT Services has extensive experience with crypto-ransomware viruses. If backups of the data are not available, in some cases we can recover the data without paying the ransom. In the worst case scenario, you will have to pay the ransom our experience has been that you will get all the data back.

Of course, mitigating these threats is the best defense, talk to us about setting up crypto-ransomware virus proof backups of your important data and good quality security software on each machine, and applying Microsoft security updates at regular intervals.