Ransomware Started Encrypting Your Files the First Five Minutes

Ransomware spreads sideways through networks and shared folders. Pulling the Ethernet cable or switching off Wi-Fi takes seconds and caps the incident at one machine. If it is a laptop on Wi-Fi, use the hardware switch or airplane mode if you can do it instantly - otherwise shut the machine down by holding the power button. A hard shutdown can lose the document you had open; leaving the machine connected can lose the file server. There is no contest.

If you manage an office: the same rule applies to the shared drive and server - isolate the affected segment first, investigate second.

1. Do not plug in your backup drive to "check it is safe". If the malware is still active, you have just handed it your last clean copy. The backup gets connected later, to a known-clean machine, by whoever is handling recovery.
2. Do not pay, and do not negotiate or click through the ransom note. Payment is covered in the companion guide - short version: it funds the next attack, guarantees nothing, and in an office it is a decision for management and authorities, never for a panicked individual.
3. Do not run random decrypters or cleaners downloaded in a hurry. Fake recovery tools are a second infection channel aimed at exactly this moment.
4. Do not wipe or reinstall before evidence is preserved - if this may become a police, insurance or compliance matter, the machine's state is evidence.

Photograph the ransom note and any error screens with your phone - including any file names, addresses or IDs shown, without clicking anything. Write down when you first noticed it, what you were doing just before (an attachment opened, a download run), and which shared folders this PC could reach. That five-line note saves hours later, for IT, for the authorities, and for working out what else on the network needs checking.