Quick Answer: How do i check whether my device or account is affected by ransomware?
Ransomware usually announces itself through encrypted files that will not open, renamed files with strange extensions, a ransom note dropped on the desktop, or security tools that suddenly stop working. On the account side, the warning signs are different: unfamiliar sign-ins, changed passwords, new forwarding rules, or sessions from devices you do not recognize. (Stop Ransomware)
The two checks are separate jobs. A device infection lives on hardware; an account compromise lives in the cloud and can happen without any file on your computer being touched. Some attackers also steal data before encrypting anything, so working files do not prove you are clean.
Before acting, confirm what you are seeing: file extensions and open failures, ransom note filenames, recent sign-in history, active sessions, installed programs, scheduled tasks, and whether your backups are connected to the same machine.
Ransomware has been the most common cyber threat reported to authorities for several years running, and the average recovery cost for a mid-sized organization now runs into the millions. Yet the single biggest factor in how badly a victim suffers is not the malware itself. It is how quickly they notice. A device caught in the first hour is a bad afternoon. A device caught in the first week is a lost business.
That gap between “infected” and “identified” is where this guide lives. Below is a practical, hands-on way to check a laptop, phone, or cloud account for ransomware, written for people who are not security professionals and do not want to become one.
Start With the Physical Clues on the Device
The old advice was simple: if your screen shows a countdown timer and a demand for Bitcoin, you have ransomware. That still happens, but modern ransomware families often work quietly. They encrypt in the background, delete shadow copies, and only reveal themselves when you try to open something.
Here is what to look for, in order of how often it shows up:
- Files that will not open. A document that suddenly demands a specific program, or throws a “file corrupted” error, is a classic sign.
- Changed file extensions. Photos that were `.jpg` and are now `.jpg.locked` or some other unfamiliar suffix.
- A ransom note. Usually a `.txt` or `.html` file sitting in every folder, often named something like `README` or `DECRYPT_INSTRUCTIONS`.
- A changed desktop wallpaper. Some families replace it with a message.
- Disabled security tools. If Windows Defender, your antivirus, or Task Manager refuses to launch, that is a serious red flag.
- Sudden, sustained disk activity. Encryption is heavy work, so drives churn and fans spin up.
A common mistake is assuming a slow computer means ransomware. Usually it means a full drive or too many browser tabs. The extension change is the tell that matters most.
Check What Is Running in the Background
Ransomware needs to execute, so checking startup items and scheduled tasks is a fast, free triage step. On Windows, open Task Manager and look at the Startup tab, then check Task Scheduler for entries you did not create. On macOS, look under System Settings, then General, then Login Items. On Android and iOS, review installed apps and any device management profiles you did not add.
The practical tip here: look for things with random names or misspelled versions of legitimate software. A scheduled task called “GoogleUpdateTask” is normal. One called “GogleUpdat” is not.
If you want a structured walkthrough for verifying suspicious files before you open them, this guide on how to check whether an apk file is safe covers the same verification mindset applied to mobile installers.
Use a Scanner, but Read the Result Carefully
Running a full antivirus or endpoint scan is still worth doing, and it takes about an hour on a modern machine. Free options from reputable vendors exist, and built-in tools on Windows and macOS have improved considerably.
Two caveats matter. First, a clean scan does not prove you are clean, because ransomware that has already finished encrypting may leave nothing for the scanner to find. Second, a scanner that flags a “potentially unwanted program” is not the same as a ransomware detection. Read the actual threat name.
For anyone confirming which family may have hit a machine, the No More Ransom project, run by Europol with police partners and security vendors, offers a free identification flow and decryption tools. Its tool list changes constantly, so check it fresh rather than trusting an old article.
Check Your Accounts Separately From Your Device
Account compromise is the part most people skip, and it is often the more dangerous of the two. An attacker with your email password does not need to encrypt a single file to cause damage. They can reset passwords elsewhere, read years of messages, and impersonate you.
Open your account security page and look at three things: recent sign-in activity, active sessions, and recovery options. Google and Microsoft both show device, location, and time for recent sign-ins. If you see a login from a country you have never visited, treat it as real until proven otherwise.
Then check for changes you did not make:
| What to check | Why it matters |
|---|---|
| Forwarding rules | Attackers silently forward your mail to themselves |
| Recovery email and phone | A changed recovery option locks you out |
| App passwords and connected apps | Old access tokens survive a password change |
| Two-factor settings | Disabled 2FA is a classic post-compromise move |
Also review password managers and cloud storage for files that suddenly will not sync or open. Cloud ransomware exists, and it encrypts the synced copy, which then propagates to every device.
Know the Difference Between a Device Infection and an Account Breach
This distinction saves people from panic and from complacency. A device infection is local: files on that machine are affected, and disconnecting it from the network limits the spread. An account breach is remote: the attacker never touches your hardware, and disconnecting your laptop does nothing.
The overlap is real, though. Stolen session cookies let an attacker ride an already-authenticated browser, so a device can look clean while the account is compromised. Conversely, an account can be perfectly secure while a machine on the same network is encrypting shared drives.
A useful habit is to verify anything that arrives as a link before clicking it, since phishing remains the most common entry point. This walkthrough on how to check whether a link is safe explains the checks in plain language.
Check Your Backups Before You Need Them
Backups are the single most effective recovery control, and they are also a diagnostic tool. If your backup drive is permanently connected to the machine, it may already be encrypted too. Disconnected or offline backups survive ransomware; always-connected ones often do not.
Test a restore of one small file. If it works, you have a recovery path. If it does not, you have just learned something important at the cheapest possible moment.
When to Escalate and Who to Tell
In the United States, the Cybersecurity and Infrastructure Security Agency publishes a StopRansomware guide covering identification, response, and reporting, and it recommends reporting incidents to CISA and to the FBI through its Internet Crime Complaint Center. The UK’s National Cyber Security Centre publishes comparable ransomware guidance for organizations and individuals.
Reporting early has practical value: it can trigger victim notification, and law enforcement sometimes holds decryption keys obtained during investigations. Paying is discouraged by every major authority, and there is no guarantee of recovery.
If you are dealing with a specific family and want to understand what victims typically face, this breakdown of The Gentlemen ransomware in 2026 covers the extortion tactics in detail. Larger incidents, such as the Rhysida ransomware attack on Berlin’s government in 2026, show how the same playbook scales up. (Ransomware)
Practical Steps That Actually Work
Here is the sequence that holds up in practice, in the order that minimizes damage:
- Disconnect from the network. Pull the cable or turn off Wi-Fi. Do not shut down, since memory can hold useful evidence.
- Photograph the ransom note and any error messages. You will need the exact wording to identify the family.
- Check the account from a different device. Sign-ins, sessions, forwarding rules, recovery options.
- Change passwords from the clean device, starting with email.
- Run a full scan and record the results.
- Test one backup restore.
- Report to the relevant authority and, for businesses, notify your insurer.
The most common mistake is the opposite order: people start deleting files or reinstalling the operating system before noting what the note said, which destroys the information needed to find a decryptor.
One more caution worth stating plainly: do not trust a “free decryptor” you find through an ad or a random forum link. Fake recovery tools are a well-documented second-stage scam targeting people who are already desperate. Use the official identification service instead.
What to Do If You Find Nothing
A clean check is good news, but it is not a permanent state. Turn on automatic updates, enable two-factor authentication everywhere it is offered, keep one backup disconnected, and set a calendar reminder to review account sign-ins quarterly. Most ransomware succeeds because of an unpatched program or a reused password, not because of sophisticated attacks.
Conclusion
Checking for ransomware comes down to two parallel investigations. On the device, look for renamed files, ransom notes, disabled security tools, and unfamiliar startup entries. In the accounts, look for strange sign-ins, changed recovery settings, and forwarding rules you never created. Neither check substitutes for the other, and a clean result on one side says nothing about the other.
The reassuring part is that none of this requires special tools or technical fluency. It requires patience, a second device to work from, and the discipline to write down what you see before you start deleting things. Victims who document first and act second recover faster and lose less, every time.
Frequently Asked Questions
Can ransomware infect a phone, or is it only a computer problem?
Phones are less commonly hit by full encryption ransomware because of app sandboxing, but they are heavily targeted by account takeover and by malicious apps that lock screens or demand payment. The account checks matter more on mobile than the file checks.
Does a clean antivirus scan mean I am definitely safe?
No. A scanner can only find what it recognizes, and ransomware that has already completed encryption may leave little behind. Treat a clean scan as one data point alongside file behavior, account activity, and backup integrity.
How long does ransomware usually take to encrypt a computer?
It varies widely by family and by how much data exists. Some encrypt a typical home machine in under an hour; others work slowly over days to avoid detection. Speed is not a reliable signal either way.
Can I recover files without paying the ransom?
Sometimes. Free decryption tools exist for some families, and offline backups restore everything if they were not connected during the attack. Check the official identification service first, since tool availability changes frequently.
What is double extortion, and why does it matter for my check?
Double extortion means attackers copy data before encrypting it, then threaten to publish it if you refuse to pay. It matters because your files may still open normally while your data has already been stolen, so account and network logs deserve the same scrutiny as file behavior.
Should I report an infection if I am an individual, not a company?
Yes, and it costs nothing. Reporting helps authorities map campaigns and can occasionally connect you with recovery options. Keep the ransom note and any error messages, since those details are what make a report useful.
