Skip to content

My files are locked and a ransom is demanded

Emergency steps when files cannot be opened, their extensions have changed, and a ransom note appears (ransomware).

TLP:CLEAR ·  2 views

Files on your computer or server cannot be opened, their names have changed, and a note demanding a ransom has appeared. Ransomware can spread to shared folders and other devices on the same network, so the first step is to disconnect.

Signs

  • File extensions change to an unfamiliar suffix, for example laporan.docx.locked.
  • Text files such as README.txt or HOW_TO_DECRYPT appear in many folders.
  • The desktop wallpaper changes to a ransom message.
  • Documents, photos, and databases fail to open or their contents look scrambled.
  • The computer is extremely busy for no reason and the antivirus switches itself off.

Do this now

  1. Unplug the network cable and turn off the device's Wi-Fi. Leave the device switched on, unless its network connection cannot be cut.
  2. Unplug flash drives, external hard drives, and connected backup drives.
  3. Inform your OPD's IT staff and colleagues who use the same shared folders or server.
  4. Photograph the ransom note on screen and note the time the files were first seen locked.
  5. Report it to KUTIM-CSIRT at Critical severity (see the Report section).
  6. Check other devices in the same room or network, and disconnect them too if they show similar signs.
  7. Prepare a list of existing backups: their location, the latest date, and whether they were connected at the time of the incident.

Don't

  • Do not pay the ransom or contact the attackers. Paying does not guarantee you will get your files back.
  • Do not delete the locked files or the ransom note; both are needed to identify the variant.
  • Do not run decryptors or cleaning tools downloaded at random from the internet.
  • Do not connect backup drives to the infected device.
  • Do not reinstall the device before the evidence has been secured.

Report

Report it through /lapor under the category Malware / Ransomware with severity Kritis (Critical). Under our service standards, the initial response for Critical is within 1 hour. Attach a photo of the ransom note and examples of the changed file names, without attaching the encrypted files themselves. Also send it to csirt@kutaitimurkab.go.id; email is received 24 hours a day and Critical reports are also handled outside working hours. Monday–Friday, 08.00–16.00 WITA, you can call (0549) 2021207.

The No More Ransom project provides decryptors for some ransomware variants. For agency devices, coordinate with KUTIM-CSIRT first before uploading sample files to third-party services.

To prevent a recurrence

  • Keep scheduled backups with at least one copy disconnected from the network, and test restoring them regularly.
  • Update the operating system and applications, especially VPNs, firewalls, and servers exposed to the internet.
  • Do not expose Remote Desktop (RDP) directly to the internet.
  • Use a standard user account for daily work and an administrator account only for installing software.
  • Be suspicious of email attachments that ask you to Enable Content or that come as password-protected ZIP files.

Report to KUTIM-CSIRT All emergency steps

Other emergency steps: