Ransomware Locked a Small Business PC — We Got Everything Back
A local tradie had his work PC encrypted by ransomware overnight. Invoices, client records, job photos — all locked. Here's how we recovered everything without paying the ransom.
Before
- 🔒 All files encrypted with .locked extension
- 💸 $800 ransom demand on screen
- 📁 3 years of business files inaccessible
- 🚫 No working backup
After
- ✅ All data recovered — zero files lost
- 💻 Clean Windows reinstall
- 🛡️ Antivirus + backup solution set up
- ⏱️ Back in business same day
What Happened
A local sole trader brought in his desktop PC after turning it on one morning to find a ransom screen. All his documents, invoices, and customer records had been encrypted — replaced with files ending in .locked. The ransom note demanded $800 in cryptocurrency.
He hadn't paid. Smart move — he called us instead.
How the Ransomware Got In
After investigation, we identified the infection vector: a phishing email disguised as an ATO tax refund notification, opened the previous evening. The attached PDF had executed a payload that silently encrypted files overnight before displaying the ransom screen.
The Windows Defender subscription had lapsed, leaving the system unprotected.
What We Did
- Isolated the PC immediately — disconnected from network to stop spread
- Identified the ransomware variant using offline tools
- Located a matching public decryption tool (this variant had been cracked by security researchers)
- Decrypted all affected files — verified against the customer's known file list
- Performed a clean Windows reinstall to guarantee no remnants
- Restored all files to the fresh system
- Installed Malwarebytes Premium + set up automatic cloud backup via OneDrive
The Outcome
The customer collected his PC the same afternoon — clean, fast, and protected. Not a single invoice or client record was lost. He left with a working backup solution and advice on spotting phishing emails in the future.
Total cost to the customer: a fraction of the ransom demand. Zero ransom paid.
"I thought I was going to lose everything or have to pay those crooks. They fixed it the same day and set me up so it can't happen again. Absolute legends."
— Sole trader, Midland WA
Dealing with a virus or ransomware?
Don't pay the ransom. Don't turn the computer off and on repeatedly. Bring it straight in.
Get Help Now