It is a horrible moment: files will not open, and a note demands money in cryptocurrency. Before anything else — breathe. Wrong moves in the first hour cause more permanent damage than the attack itself.
First, the four steps
Disconnect the machine from the network but do not switch it off. Photograph the ransom note and one encrypted file name — this identifies the strain, and some strains have free decryption tools published by researchers. Physically unplug your backup drives before the malware finds them. Then call a professional before running any cleaner tool or reinstalling Windows — both can permanently destroy data that was recoverable.
So — should you pay?
Our honest position: payment is a last resort, never a first response. Three reasons. You are dealing with criminals, so payment is no guarantee — plenty of victims pay and receive nothing, or receive a broken decryptor. Payment marks you as someone who pays, which invites a second visit. And every payment funds the next hundred attacks.
The right question is not "should we pay?" but "what can we recover without them?" — and the answer is often more than people fear.
What recovery without paying looks like
If any backup survived — even an old one — the crisis is mostly over; you rebuild and lose only the gap. Where there is no backup, professionals check for identified strains with free decryptors, shadow copies the malware missed, recoverable deleted originals, and untouched data on other devices. Only when every honest route is exhausted does the payment conversation even begin — and by then you make it with clear eyes, knowing exactly what is and is not recoverable.
Our Ransomware & Corruption Recovery page explains the process, and the phone consultation costs nothing: +91 63909 99366. One more thing — after recovery, the ₹500-a-month habit that prevents the sequel is called an offsite backup. We set those up too.