Recovering from Ransomware: Files with a Strange Extension and a Ransom Note — What to Do in the First Hour, Whether to Pay and How to Get Your Data and Your Business Back

Ransomware is one of the most serious threats to small companies and private users. The scenario is almost always the same: suddenly documents, spreadsheets, photos and 1C databases won't open, files have gained a new, unfamiliar extension, and every folder contains a text file explaining where to send money for the decryption key. Often it's not just files on one computer that are encrypted, but network folders, the server and connected external drives too. The business grinds to a halt. In this situation it's important not to panic and not to do anything that lowers the chances of recovery.

First steps

• Isolate infected devices. Unplug the network cable and turn off Wi-Fi on computers where encrypted files are visible, so the ransomware can't reach other machines and network drives. Disconnect external drives and the NAS if they haven't been hit yet.
• Don't delete the ransom notes or the encrypted files. They're needed to identify the ransomware strain and possibly find a way to decrypt.
• Don't reinstall the system or format drives straight away — you can destroy the traces used to recover data, and the data itself.
• Don't run random "decryptors" from the internet — some are fakes that ruin the files for good or install a new virus.
• Tell your staff not to connect laptops or USB sticks to the infected network.

Should you pay the ransom

Security specialists and law enforcement advise against paying. Payment doesn't guarantee you'll get a key: the criminals may vanish, send a decryptor that doesn't work or demand more. Payment also funds further attacks, and companies that pay once are often targeted again. In some cases paying can also carry legal risks. The decision always rests with the data owner, but every other option should be explored first.

Ways to get the data back

• Backups. The most reliable route — if there's a copy the ransomware couldn't reach: on a disconnected drive, in the cloud with version history, on protected storage.
• Free decryptors. For some ransomware families, security researchers have found flaws in the encryption or obtained the keys, and official free tools exist. It's important to identify the strain precisely.
• Cloud version history. If files were synced to the cloud, many services let you roll a folder back to its state before the infection.
• Shadow copies and leftover data. Ransomware usually deletes system shadow copies, but not always successfully. Sometimes the original files, deleted after the encrypted versions were created, remain on the drive and can be recovered.
• Partial recovery. Some ransomware encrypts only the beginning of large files, so part of the content — for example, of databases — can be extracted.

After recovery

Getting the files back is only half the job. You need to work out how the ransomware got into the network: through remote desktop exposed to the internet, an email attachment, a cracked password, a vulnerable NAS. Infected computers must be fully cleaned — usually a reinstall from scratch rather than just an antivirus scan, because attackers often leave themselves extra access. Every password that may have been compromised must be changed. Without this, a repeat attack a few weeks later is a common outcome.

How to protect yourself in future

• Backups following the 3-2-1 rule, with at least one disconnected from the network or protected from changes.
• Closed-off remote access — only via VPN with two-factor protection.
• Regular updates for Windows, software, the NAS and the router.
• Antivirus with ransomware protection on every computer.
• Limited user rights: staff don't work as administrators.
• Training staff to recognise phishing emails.

What our technician does

1. Isolates infected devices and stops the spread.
2. Identifies the ransomware strain and checks for known decryptors.
3. Looks for surviving copies: backups, cloud versions, shadow copies, deleted originals.
4. Recovers the data, fully cleans and reinstalls the systems, and changes passwords.
5. Finds the entry point, closes it, and sets up protected backups.

A real example

A dental clinic in Vazisubani found one morning that patient records, the schedule and the accounts on the server and three computers were encrypted. The cause turned out to be remote desktop exposed to the internet for a visiting accountant, with a simple password. There was a backup, but on an external drive permanently connected to the server — so it was encrypted too. We identified the strain, for which unfortunately no decryptor existed, but found the deleted original database files on the server's drive and recovered it almost entirely, and recovered documents from the email's cloud version history. We then reinstalled every system, closed remote access behind a VPN and set up backups to a removable drive and the cloud.

Call a technician

If your files have been encrypted, isolate the computers and contact us immediately — we'll help in any district of Tbilisi around the clock. Learn more on our virus removal, data recovery and local network setup pages.