ojava
Start free trial

All guides

Ransomware-like activity

What happened

Many files were changed, renamed or deleted very fast, backups were deleted, or a hidden decoy file placed by Ojava was changed. This is how ransomware encrypts files before asking for money.

How serious

Critical: act within the hour.

Steps: Windows PC

  1. Take the PC off the network now: unplug the cable and turn off Wi-Fi. Don't switch it off: what's in memory helps your IT provider.

  2. Check that your backups are intact and not connected to this PC; disconnect any external backup disk.

  3. Ask the person at that PC what they were doing at that time (installing something, a link in an email, a USB stick).

  4. Change the passwords used on that PC (Windows, Microsoft 365 or Google, banking) from ANOTHER, clean device.

How to check it’s fixed

Fixed when the deep scan finds nothing, protection is on again and Ojava shows the PC as healthy for 24 hours.

When to call your IT provider

Call your IT provider now. Do not pay any ransom and do not restart the PC.