Ransomware strains can churn through many files before you've even finished deciding whether to unplug the router. I didn't have a real answer to that the first time I tried to write down an actual malware-recovery protocol (I'm still not totally sure there's a clean one). What I've got instead, after running more antivirus suites through my own network than any one person probably should, is a specific security protocol for the first twenty-four hours of a suspected infection — a ransomware-prevention routine built less on dread and more on knowing exactly what each minute of indecision costs.
The trigger this time wasn't anything dramatic — just the gaming rig's drive light stuttering in a pattern that didn't match the overnight backup job it was supposed to be running. Nothing was supposed to be touching that drive at all. The rhythm was wrong, choppy instead of steady, and that's the kind of thing you only notice once you've watched enough normal disk activity to know what normal looks like.
Everything I've tested since the ransom note came out of my old office's printers back in 2022 points to one thing before anything else: the first hour of a suspected infection is where people make the mistake that costs them everything, and it's usually not the mistake they're bracing for.
Why I Don't Pull the Cable in the First Thirty Seconds
My gut reaction was still to rip the Ethernet cable out of the wall and kill the Wi-Fi at the router — the move every security-protocol checklist tells you to trust, since a machine that can't talk to the internet can't exfiltrate anything new. That instinct isn't wrong, exactly. It's just incomplete. Some of the more advanced Ransomware-as-a-Service (RaaS) operations now check in with a command-and-control server on a schedule, and if that heartbeat goes quiet because you yanked the cable, a subset of them read the silence as a sign they've been caught in a sandbox and trigger an anti-forensic wipe rather than risk handing researchers a usable decryption key. Disconnect too fast on one of those strains and you can destroy the only copy of a key that would have gotten your files back.
Wait too long and the math runs against you just as hard. LockBit 3.0 can reportedly encrypt around twenty-five thousand files a minute, so five minutes spent debating cables is five minutes you don't get back on a drive that size. The actual call isn't instinctive, it's a quick triage: if encryption is already visibly running (file extensions changing, a ransom note already open on screen) you disconnect immediately, because active damage outweighs forensic risk. If you've only caught a suspicious process before it's started mass-renaming anything, that's when the extra minute to let an offline tool capture what's running is worth more than cutting the connection on reflex. Kevin, a sysadmin friend I trade benchmark notes with over a private Discord, forwarded me a writeup on exactly this self-destruct behavior with zero context and at an odd hour, which is just how he operates — but it matched what testing had already shown me.
What My Antivirus Missed While I Watched
Four hours into scanning, my primary suite still hadn't made a sound: no alert, no quarantine entry, nothing in the log. That silence, more than any popup ever could, is what still gets under my skin about modern security software. It sits there at idle burning something like three hundred megabytes of RAM and promising full protection, and then a signed driver riding a stolen certificate walks right past the gate. A scanner built mostly around matching known signatures doesn't stand much of a chance against something wearing a legitimate signature; a tool actually watching behavior in real time would have had a better shot at flagging a brand-new driver sitting in the temp folder days before I noticed it on my own.
At that point I stopped trusting anything the Windows task manager told me, because malware hooked in at the kernel level can lie straight to the OS about what's actually running — a different problem entirely from whatever a kernel-level protection feature promises on the box it came in. I keep a known-clean Linux USB drive in a desk drawer for exactly this situation, and booting from it is about as close to air-gapped as a home scan gets: an environment the infected Windows install has no way to touch or influence. I've written before about The Gap: How I Swap Endpoint Protection Without a Single Minute of Vulnerability, but when you already suspect you're compromised, you don't bolt a second product onto a possibly-blind one. You step outside the operating system entirely.
Scanning the Windows partition from that Linux environment is how I actually found it: a small file sitting in a temp folder, built to look like a system driver, with a compile date only days old, buried somewhere in close to a terabyte and a half of real data on a two-terabyte drive. Windows 11 itself only needs sixty-four gigabytes to install, so everything past that is mine, and sorting the legitimate from the planted gets tedious fast without a clean environment doing the looking instead of a possibly-compromised one.
Does a Three-Copy Backup Rule Actually Hold Up This Late at Night?
Somewhere around the point the adrenaline wore off and the specific exhaustion that comes with this kind of night set in, I started running through my backup setup instead of the infection itself. The 3-2-1 rule has kept me out of real trouble more than once: three copies of anything that matters, on two different kinds of media, with one copy sitting somewhere the network simply can't reach. My one off-site copy lives on a drive inside a fireproof safe, unplugged — and the unplugged part matters more than the fireproof part. An offline backup a ransomware strain has no network path to is the only kind of backup that actually counts as a fallback, instead of just a second place for the same infection to spread.
Most of the house runs on wired Cat6 instead of Wi-Fi, partly for speed and partly because I like knowing exactly where every run goes. Cat6 tops out around fifty-five meters for a full 10-gigabit link, which is more than enough for a house this size, but a wired network is still just a faster road for something trying to move sideways from one machine to another if nothing is segmenting it. That's the piece people skip: a locked front door doesn't help much if every room inside shares the same key, and a home network with no separation between the gaming rig, the Mac mini, and whatever else is plugged in is exactly that.
Eight Weeks on Real-Time Scanning Instead of a Nightly Job
For a long stretch before any of this, the only thing standing between that gaming rig and the internet was Malwarebytes Free running a scan once a night on a schedule, with nothing watching in between (no real-time component at all). It caught plenty of garbage over the months I ran it that way, so the tool itself isn't the problem. The problem is that a scheduled scan only checks the house after the fact, like a guard who walks the building once overnight instead of watching the cameras live. Eight weeks after I moved that machine onto something with always-on, real-time monitoring, the difference wasn't dramatic. It just showed up earlier: a dropped installer flagged within seconds instead of sitting there until whatever hour the scheduled job happened to run.
The suite I eventually settled that machine on also leans lightweight and quiet instead of chatty about "optimizing startup apps" or whatever upsell is trending that quarter — a preference I wrote about at length in The Invisible Guardian: Why I Traded Heavy Suites for ESET After My 2022 Nightmare, and nothing I've tested since has moved me off it.
A pettier nudge mattered too. One renewal notice for another suite landed with a number at the bottom higher than what I'd paid the year before, no explanation, no email asking if I wanted the upgrade, just a quiet assumption I wouldn't check it against the date I keep written on the whiteboard next to my desk. Pricing games like that are their own rabbit hole I've gone deep on elsewhere, but they're also exactly the kind of thing that makes you actually read what a renewal is buying you instead of clicking through it.
When Cleaning an Infection Isn't Enough
By the next morning I had two options: try to clean the specific thing I'd found, or reimage the whole drive the way I did back in 2022. Cleaning a single file is a different job than confirming nothing else got dropped alongside it, and a repair utility built to fix corrupted system files isn't built to answer that question either. It solves a completely different problem than an antivirus scan does, and conflating the two is how people end up reinfecting a drive they believe is clean. If one disguised driver got through, there's no reliable way to rule out a second hook sitting somewhere in firmware or the UEFI, and I wasn't willing to bet my data on a scan being thorough enough to prove a negative.
So I wiped it. Every partition, a fresh install of Windows 11, files pulled back from the cold-storage drive, and the rest of that day spent resetting every password I had saved anywhere. That's a separate chore from scanning for malware, and a password manager doesn't actually solve it on its own — it just makes the resetting faster once you've already decided to do it.
What I Told Raymond When He Called
Raymond, who runs a small accounting office and calls me whenever a scan notification confuses his bookkeeper, asked the obvious question when I told him about all this: wouldn't the more expensive suite have caught the driver before it got that far? Not necessarily. Price has surprisingly little to do with whether one specific technique gets caught on one specific day, and the honest answer I gave him was the same one I'd give anyone running a small office with no IT staff of their own: write the actual steps down before you need them, because nobody reads a calm protocol while their files are actively encrypting in front of them.
The One Protocol Rule That Actually Mattered
The lesson that stuck wasn't about software at all. It's that the twenty-four hours after a suspected infection go better when the decisions are already made before the panic starts: when to disconnect, where the clean-boot drive lives, which backup copy is actually offline, who to call if you're running a small office and don't have time to work any of this out live. A locked door only works if the person holding the key already knows which door it opens, and figuring that out while something is actively rattling the handle is how a good protocol turns into bad improvisation. Write it down now, while nothing is on fire, and the next flickering drive light is just a data point instead of an emergency.