A customer opened a file attachment, and now her PC is infected with ransomware. She’s unable to open any of her files. Which action would you take first?
A. Reinstall the operating system
B. Run an antivirus scan
C. Pay the ransom to recover the data
D. Disconnect the PC from the network
E. Restore files from backup
Answer: D. Disconnect the PC from the network
The most paramount task to be done when a PC is ransomed is to remove it from the network immediately. Thus, the network is protected from further spreading by the ransomware and the possibility to reach other network resources is limited. Thus, shutting down the networked computer should be the initial action that is taken to safely isolate and protect the data from any damage or loss. Following the disconnection, the steps ahead are performing anti-malware scanning, doing a restore from backup, or worst case reinstalling the operating system, depending on the extent of the infections and whether back-ups are available.