Malware · critical

How to fixRANSOMWARE_ENCRYPTION_ATTACK

Ransomware File Encryption & Boot Lockout

What this error means

This critical-severity issue affects the malware/security. This diagnosis detects ransomware-like active encryption behavior on system folders, resulting in encrypted document extensions, ransom notes (.txt/.html), and locked administrative panels. Typical causes include executing unverified attachments or cracked software payloads, compromised Server Message Block (SMB) exposures on local networks and outdated security configuration allowing remote code execution. Use the steps below to track down and fix the cause.

Before you begin

Save open work and back up important files. Use instructions for your exact device and software version. If Windows cannot start, see the startup guide.

Work through these checks

0 of 4 complete
01Disconnect the affected computer immediately from local networks and the internet to halt spreading.
  1. Disconnect the affected computer immediately from local networks and the internet to halt spreading.
What to expect

Check whether the original symptom still occurs.

If it does not help

Continue only if this check applies to your device. Consult its manufacturer if you are unsure.

Browse related errors
02Boot the system into Safe Mode with Command Prompt to bypass startup malware vectors.
  1. Boot the system into Safe Mode with Command Prompt to bypass startup malware vectors.
What to expect

Check whether the original symptom still occurs.

If it does not help

Continue only if this check applies to your device. Consult its manufacturer if you are unsure.

Browse related errors
03Trigger a Microsoft Defender Offline scan to locate and clean persistent trojans.
  1. Trigger a Microsoft Defender Offline scan to locate and clean persistent trojans.
What to expect

Check whether the original symptom still occurs.

If it does not help

Continue only if this check applies to your device. Consult its manufacturer if you are unsure.

Browse related errors
04Restore decrypted documents exclusively from a secure, isolated offline backup source.
  1. Restore decrypted documents exclusively from a secure, isolated offline backup source.
What to expect

Check whether the original symptom still occurs.

If it does not help

Continue only if this check applies to your device. Consult its manufacturer if you are unsure.

Browse related errors

Possible causes

  • Executing unverified attachments or cracked software payloads.
  • Compromised Server Message Block (SMB) exposures on local networks.
  • Outdated security configuration allowing remote code execution.