Immediate steps

1. Isolate the infected device—disconnect wifi, Ethernet, and Bluetooth.
2. Don't power off—you'll destroy evidence.
3. Document everything—screenshots, timestamps, affected files.
4. Determine scope—find out how far the attacker got before you do anything else.
5. Confirm your environment is malware-free before restoring anything.
6. Restore from your most recent clean backup.
7. Reset all credentials, especially admin and service accounts.
8. Validate systems before reconnecting to the network.

Do not

• Pay the ransom
• Restore before containing the threat
• Skip root cause analysis

Attackers encrypt your files and display a ransom note with payment instructions. Pay up, they say, and you'll get your files back. Maybe.

Businesses, hospitals, schools, and even home users can be targeted. Attackers often exfiltrate sensitive data, then threaten to publish your private information online if you don't pay. Some will delete your files entirely if you attempt removal improperly. Take these threats seriously. Verizon's 2025 DBIR found ransomware present in 44% of confirmed breaches, up from 32% prior.

So how do you remove ransomware safely? The short answer: carefully, methodically, and in the right order.

Here are some common signs you'll see after infection:

• Unfamiliar file extensions (e.g., .locked, .encrypted, .crypted),
• Inability to access files (documents, images, databases) that used to open without issue
• The ransom note itself—usually a text or HTML file, but it can also be a message box that appears on your desktop or inside affected folders
• Sluggish system performance as cybercriminals encrypt files across your directories
• Disabled or tampered antivirus and security software
• Network traffic going to unusual locations

If you're asking, "How do I remove ransomware right now?" start here.

Isolate the system

Turn off wifi, unplug the Ethernet cable, and disable Bluetooth. If other systems show signs of infection, isolate those too. Don't power off devices just yet. Doing so can make forensic recovery difficult and destroy evidence you'll need later.

Preserve evidence

Before you run any tools or restore any files, document everything. Take screenshots of the ransom note. List the affected files and systems. Record timestamps where possible. If you can, capture system memory and log files.

Evidence helps you determine what variant you're dealing with, how the attacker got in, and other information your insurance company, legal counsel, and law enforcement will ask for later.

Determine scope

Attackers frequently spend weeks tunneling through your network and escalating privileges before triggering encryption. IBM's 2024 Cost of a Data Breach report puts the average containment time at 64 days. The faster you determine the scope, the faster that clock stops.

If you're wondering how to undo ransomware damage after encryption has already started, your options depend entirely on whether a decryptor exists for your variant and how clean your backups are.

Restore from clean backups

Make sure you know how to delete ransomware executables fully and that your environment is completely malware-free before restoring backups. Plug into an infected system, and you just reinfected yourself. Once you've verified your environment, restore from your most recent clean backup.

No backups? Your options narrow quickly. Visit nomoreransom.org to see if free decryptors are available for your variant. If none exist, consider bringing in professional forensics and start documenting your process for your insurance company. Do not pay the ransom. According to Verizon, 64% of ransomware victims declined to pay last year, up from 50% in the previous two years.

Reset credentials

Cybercriminals are savvy, and they most likely nabbed your passwords, too. After containment, and before you re-enable any connected systems, reset all passwords—especially for admin accounts, service accounts, and any account with elevated privileges. Enable multi-factor authentication (MFA) wherever possible.

Validate before reconnecting

Make sure your systems are clean before reconnecting them to your network. Run your endpoint security solutions, check for malicious processes and scheduled tasks, and investigate how the attacker may have maintained persistence.

Rushing through the reconnection phase causes more failed recoveries than almost anything else.

Knowing how to get rid of ransomware is only part of the job—the mistakes you make during removal can be just as damaging as the attack itself.

Skipping root cause analysis

If you fail to identify how the attacker gained access—phishing email, unpatched vulnerability, exposed remote desktop protocol (RDP)—you're doomed to repeat it.

Restoring too quickly

Downtime costs money, and leadership knows it. But restoring before you've contained the threat or know for certain your environment is malware-free can erase hours of recovery work in minutes. Organizations experience an average of 24 days of downtime after a ransomware attack, according to Statista. A few extra hours to validate your environment is nothing compared to that.

What's the single greatest defense against ransomware? There isn't one, but combining the following with proactive endpoint detection and response (EDR) will bring you as close as you can get.

• Maintain offline backups: Store backups offline or in immutable cloud storage, isolated from your primary network.
• Patch consistently: One of the most common entry points is unpatched vulnerabilities. Verizon's 2025 DBIR found that, across breaches, credential abuse (22%) and exploitation of vulnerabilities (20%) are the leading initial attack vectors, with phishing frequently close behind—together accounting for around 42% of known initial access paths.
• Filter email: Phishing remains one of the easiest and the most common ways attackers gain a foothold, including for ransomware campaigns.
• Enforce least privilege: Don't grant administrative access where it isn't needed.
• Deploy EDR: A proactive EDR solution like Huntress is designed to detect ransomware behavior early, disrupt attacks in real time, and contain threats before they spread across your endpoints.

Can ransomware be removed? Yes, but removal alone isn't enough. The malware executable can be eliminated from your system, but that doesn't decrypt your files or close the door the attacker used to get in.

Can ransomware be removed by a factory reset? A factory reset will remove the ransomware infection by erasing the OS, but it also deletes everything else, including your encrypted files. If you don't have clean backups you can restore, a factory reset puts your data completely and permanently at risk.

What's the best tool to remove ransomware? There's no single tool that handles every variant. A reputable EDR solution handles the detection and removal of the malware itself. For file recovery, check nomoreransom.org for free decryptors before assuming your data is gone. If feasible, engage professional incident response.

Huntress Managed EDR lets you quickly detect and contain ransomware, investigate affected endpoints, and actively remediate malicious footholds all backed by our 24/7 AI-centric SOC. With our team monitoring your endpoints 24/7/365, you're not stuck piecing together incidents alone. We surface malicious activity, persistence mechanisms, and risky exposures, and guide you step-by-step through remediation.

Get a demo of the Huntress agentic security platform and find out what could be hiding in your environment.