Ransomware for people who just want their photos back
How home infections start, what to do in the first hour, and backups that survive the event.
Ransomware encrypts files and then offers a key for money. On a home computer it often arrives as a fake invoice, a cracked program, or a remote-support scare. You do not need to be a company to be a target. You only need files you care about and a backup you never tested.
How a home infection usually starts
Someone clicks. The attachment is a disc image or a scripted document. The “repair” tool is malware. A pop-up says the FBI locked the PC and a voice on a premium-rate number will help. That help installs the encryptor.
Once it runs, documents, photos, and sometimes backups on attached drives change extension and refuse to open. A note appears with a deadline and a crypto address. The note is designed to panic you into paying before you think.
Paying does not guarantee a key. Paying also marks you as someone who pays. Restoring from a backup you control is the actual exit. Prevention is cheaper than either.
What to do in the first hour
Disconnect the machine from Wi-Fi and Ethernet. Do not pay from that computer. Do not run random “decryptor” tools you found in a forum while the infection is still live.
From a different device, change email and banking passwords. If you use a password manager in the cloud, change its master flow from the phone app, not from the sick PC.
If the files matter, copy nothing off the infected disk until someone who understands malware says the copier is safe. You can spread it to the USB stick you were about to use as a “backup.”
Report it if you are in a place that has a cyber crime reporting path. For a household, the practical move is rebuild and restore.
Backups that survive the event
A backup on the same disk is not a backup. A drive that stays plugged in all day can be encrypted too. Use a copy that is unplugged, or a cloud account that versions files so yesterday’s photos still exist.
Test a restore on a boring folder this weekend. A backup job that has never been opened is a story you tell yourself.
Keep the operating system and the browser current. Uninstall software you do not use. That shrinks the number of doors.
How to make ransomware rare
- Do not install pirated apps or “activators.”
- Do not let remote-support programs run because a pop-up told you to.
- Turn on the OS firewall and the built-in ransomware protections if you have them.
- Keep one offline copy of the photos you would grieve.
Ransomware is extortion with software. The defense is not bravery. It is a copy of your life that does not sit on the same machine that just opened a strange attachment.