Your McAfee software found possible ransomware

Your McAfee software sends you to this page if it thinks that your PC is infected with ransomware. Your software also shows you this message:

We found possible ransomware
The message looks like:

The message tells you why we think your PC is infected. For example, you see:

• The app that we think is performing the suspicious activity, and
• The file or files that the app has changed
   

What you need to do if McAfee software finds possible ransomware

Review the details in the message and decide whether to Allow the changes, or Quarantine the suspicious app.

Use these suggestions to help you decide what action to take:

• Allow change: Click this button if you think the highlighted activity is legitimate.
  For example, you might recognize that the mentioned app is a game that you have installed. You see that the files being changed are related to that game. In this situation, you can safely Allow the change and continue to use your PC normally.
   
• Quarantine: Click this button if you are unsure about the activity shown in the message. The suspicious file is then quarantined, and you can continue to use your PC normally. This option is the safest one to take if you aren't certain that the activity is legitimate. Don't worry about quarantined items becoming lost; you can restore them back to their original location at any time.

How you can recover files from quarantine

Quarantined files are blocked and stored in a secure location on your computer, for your safety. If you later realize that any files were wrongly quarantined, you can easily restore them. When you restore an item from quarantine, you move the file or app from our secure location to its original location.
For more information, see How to delete or restore quarantined files or programs.
 

How you can avoid becoming a victim of ransomware

There are some simple things that you can do to avoid becoming a victim of ransomware. For example:

• Think before you click. If you receive an email that contains an attachment, think twice before clicking it. If you didn't expect it or it looks suspicious, delete it, even if it seems to come from someone you know. You can always ask them to send it again if it is legitimate.
   
• Back up your files. Always make sure that your files are backed up. That way, if they become compromised in a ransomware attack, you can wipe your disk drive clean and restore your data from the backup. Remember, backups can also get infected. You must disconnect your backup drives from your PC when possible, to prevent an infection from happening.
   
• Update your PC and devices. Make sure your PC's operating system is up to date. Software updates contain security improvements to secure your PC and make it harder for ransomware and viruses to infect it.

We have a video that shows how to protect your PC from malware and ransomware. You can view it here:

To view and subscribe to more videos, visit the official McAfee YouTube channel.

Update your software

To reduce the chance of your PC becoming infected by malware, always make sure that your McAfee and Windows software is up to date:

• Update your McAfee security software
  New viruses and threats appear frequently, so it is important to keep your security software up to date. Your McAfee Windows security product is designed to 'auto update' to make sure that you always have the latest protection. But, you can verify that your software is up to date. For more information, see How to confirm that your McAfee software for Windows is up to date.
   
• Apply Microsoft Windows security updates
  Make sure that your Windows operating system is fully up to date:
  1. Click Start  icon.
  2. In the search dialog box:
     1. Type Windows update.
     2. Press Enter.
         
  3. Click Check for updates.
  4. Follow the prompts. Windows downloads and applies any important updates.
      
     NOTES: 
     • You can also follow the steps in the Microsoft Windows Update FAQ.
     • Microsoft has made security updates to protect different versions of Windows, including older versions of Windows like Windows XP and Windows Server 2003, against the loopholes used by certain types of ransomware. If you are using one of these operating systems, see this Microsoft article.

Find out more

To learn more about ransomware, visit the No More Ransom website. McAfee, Kaspersky Labs, the National High Tech Crime Unit of the Netherlands' police, and Europol's European Cybercrime Centre created this website.

No More Ransom aims to help victims of ransomware retrieve their encrypted data without having to pay the criminals. 

For more information, see Frequently Asked Questions on ransomware.