Ransomware is one of those online threats that is far less scary than it sounds. With a bit of forward planning, and the ability to follow the steps shown here, you can normally remove ransomware from an infected PC in no time at all (ok, a bit of time, but not too much). This guide assumes you have a restore point on your Windows PC that you can roll back to.
1. Turn the Computer Off
The first thing to do, apart from keeping calm, is to turn off your computer. You will need to force it to shut down, as the ransomware will normally disable menus and controls. The easiest way to force your computer to shut down, is to press and hold the power button (on the laptop or on the tower) for a few seconds, until the PC turns off.
2. Boot into Safe Mode
To boot in to Safe Mode, you need to press the F8 button on the keyboard at the right time as the PC starts up. The easiest way to do this is to press the power button, and immediately start tapping F8 every second until a black screen with white writing appears. If you miss getting in to Safe Mode, just turn the PC off again (see above) and try once more.
3. Safe Mode with Command Prompt
From the options on screen, use the arrow keys on the keyboard to highlight “Safe Mode with Command Prompt” and press Enter/Return. White text will stream up the screen, and then eventually stop and you will see a blinking cursor. You now need to type the following, and them press Enter:
4. System Restore Tool
The System Restore tool should now load on screen. If there is more than one restore point shown in the window, choose the one that you know was before you got infected with the Ransomware. Follow the instructions (clicking Nest, etc., when prompted) and wait for the restore process to complete. This can take a while, so just give it time.
5. Reboot and Scan Your PC
Reboot your PC when prompted to, and then immediately run your chosen antivirus program. Let it do a complete scan of all of your hard drives. Again, this might take a while.
Your PC should now be back in fully working order. It might be an idea to change your antivirus software (after all, it missed the ransomware last time around) and then rescan your PC again. Remember to set regular restore points, so if you ever need to remove ransomware again, you will be ready.