Some ransomware warnings are fake browser pop-ups, while real ransomware may encrypt files or disrupt access. The first job is to avoid making the situation worse.
What this usually means
Pop-ups, browser redirects, unwanted programs, account alerts, and remote-access activity require different responses. Avoid calling numbers in warnings or installing another unknown cleanup tool.
Practical checks and decisions
Disconnect the affected computer from networks and external drives
For “disconnect the affected computer from networks and external drives,” identify the only original copy before changing the computer. When the storage is stable, make an independent copy and open several representative files so a sync icon is not mistaken for a verified backup.
Do not call a phone number displayed in a browser warning
Use “do not call a phone number displayed in a browser warning” to separate a display-setting problem from physical damage. Record whether sound, lights, or controller response continue when the picture disappears, and whether safe-mode video changes the result.
Use another trusted device for essential account and business communication
Before completing “use another trusted device for essential account and business communication,” confirm that you control the recovery email, phone, and authenticator. Save backup codes somewhere separate from the computer and never give a caller, pop-up, or remote technician a one-time verification code.
Preserve details and get help before wiping, paying, or reconnecting backups
Finish “preserve details and get help before wiping, paying, or reconnecting backups” with a restore test rather than an assumption. Open files from the backup, confirm dates and folder structure, and retain an independent copy until the new location has been used successfully.
When a professional diagnosis makes sense
Professional diagnosis is useful when the same symptom returns, important work or files are interrupted, the computer cannot start reliably, or the next test would involve parts, resets, unfamiliar commands, or changes you cannot easily reverse. Bring the exact messages and a short history of what changed before what to do after a ransomware warning became a concern.
For hands-on or remote help, review the related service, or browse the Help Center for another guide.
