Microsoft Explains Ransomware Basics and Preventive Measures for Personal PCs

According to Microsoft Support, ransomware is malware that encrypts files or prevents use of a PC in order to demand money, and on network-connected devices it can spread to other endpoints or shared storage. It cites infection vectors such as “visiting dangerous websites,” “opening unfamiliar attachments,” and “clicking malicious links in social media or messages.”

The page lists concrete defenses. It recommends keeping Windows and applications up to date, enabling Windows Security (formerly Windows Defender), turning on Controlled Folder Access in Windows 10/11, using the latest browser, and rebooting periodically. It encourages saving important files to OneDrive and explains that OneDrive offers ransomware detection and recovery features as well as file versioning.

If infection is suspected, the guidance is to scan and remove malware with anti-malware products such as Windows Security. In the event of an actual ransomware infection, Microsoft advises first fully removing the malware and then attempting to restore from backups, and it clearly warns against paying the ransom.

If a ransom has already been paid, Microsoft recommends immediately contacting your bank and local authorities, and if payment was by credit card, considering stopping the transaction or pursuing a refund. It provides reporting contacts for fraud hotlines in various countries (for example: Action Fraud in the UK and OnGuardOnline in the US). For businesses and large environments, Microsoft also recommends using advanced protections such as Microsoft 365 Advanced Protection and Defender ATP.