---

name: ransomware-first-response description: "Handle the first hour of a suspected ransomware or malware infection calmly and correctly — contain it, preserve options, and avoid the moves that make it worse. Use when asked what to do about ransomware, my files are encrypted with a ransom note, I think I have malware, or my computer's been hacked. Produces an immediate containment checklist, a preserve-evidence-and-options step, a recovery path (backups, known decryptors, professional help), guidance on the ransom-payment decision, and reporting steps — for personal/small-setup use, not a substitute for professional incident response."

Ransomware First Response

The first hour decides how bad a ransomware or malware incident gets. Panic leads to the wrong moves — paying immediately, wiping evidence, or reconnecting an infected machine and spreading it. This gives a calm, correct sequence: isolate, preserve your options, and recover from the safest source — while being honest that a serious business incident needs professional responders.

What This Skill Produces

• Immediate containment — disconnect from networks and shared drives to stop spread, without destroying recovery options
• Preserve evidence & options — don't wipe or pay reflexively; photograph the ransom note, note timing, keep the door open
• The recovery path — restore from clean offline backups, check for a known/legitimate decryptor, or engage a professional
• The payment decision — the honest tradeoffs and risks of paying (no guarantee, funds crime, marks you as payer)
• Reporting — the authorities/agencies to notify, and (for orgs) any breach-notification duties
• A scope flag — personal/small setup vs. a business incident that needs real incident-response help

Required Inputs

Ask for these if not provided:

• What you're seeing — ransom note, encrypted/renamed files, pop-ups, or just suspicious behavior
• The setup — personal device, home network, or a business/multi-device environment
• Backups — do you have recent offline/cloud backups, and are they disconnected
• Spread — is it one device or possibly shared drives/other machines
• Sensitivity — is sensitive/regulated data involved

Framework: Isolate, Preserve, Recover — Don't Panic

1. Isolate now. Disconnect the device from Wi-Fi/network and unplug shared/external drives to stop encryption from spreading — but don't start deleting.
2. Don't destroy your options. Don't wipe, don't reformat yet, and don't pay on impulse. Photograph the ransom note and record what/when you noticed.
3. Recover from clean backups. The best outcome is wiping and restoring from a known-good offline backup — verify it wasn't connected during infection.
4. Check for legitimate decryptors. Some ransomware strains have free, reputable decryptors via official security projects — check before considering payment.
5. Weigh payment honestly. Paying is risky: no guarantee of recovery, it funds criminals, and it flags you. Treat it as a last resort, ideally with professional advice.
6. Report and, if serious, get help. Notify the relevant authorities; for a business or sensitive-data incident, engage professional incident response and check notification duties.

Output Format

Suspected [ransomware/malware] · [personal/business] · backups: [yes/no]

Now (first minutes)

1. Disconnect network + unplug external/shared drives.
2. Don't wipe, don't pay yet. Photograph the ransom note; note time/first sign.
3. Isolate any other devices that share the network/drives.

Recover: wipe + restore from a clean offline backup → or check for a legitimate free decryptor → or engage a professional. Payment: last resort, high risk — [tradeoffs]; get advice first. Report: [relevant authority/agency] · [breach-notification duties if applicable].

This is first-response guidance for a personal/small setup. A business incident, or anything with sensitive/regulated data, needs professional incident responders — engage them early.

Quality Checks

• Containment (disconnect network/drives) is the first action
• Warns against wiping or paying reflexively; preserve evidence
• Prioritizes restoring from a verified offline backup
• Mentions checking for legitimate free decryptors before payment
• Presents the payment decision honestly as a risky last resort
• Includes reporting and flags when to get professional IR help

Anti-Patterns

• Paying immediately out of panic.
• Reformatting/wiping before preserving evidence and confirming backups.
• Reconnecting the infected device and spreading it.
• Restoring from a backup that was connected during infection.
• Treating a serious business breach as a DIY job.

Example Trigger Phrases

• "My files are all encrypted and there's a ransom note — what do I do?"
• "I think I've got ransomware, help me not make it worse."
• "Suspicious pop-up locked my computer demanding payment."
• "Should I pay the ransom to get my files back?"
• "Malware on my work laptop — what's my first move?"