Ransomware from email attachment: fix and recover files

Cause 1: You opened a fake invoice or shipping label attachment

This is the number one way ransomware gets in. You get an email that looks like it's from FedEx, UPS, or a vendor saying "Your invoice is overdue" or "Shipping label attached." You click the .docm or .js file, and boom — files start renaming to .locked or .encrypted within seconds.

I know this is scary. Your photos, spreadsheets, documents — all with weird extensions. A popup demands $500 in Bitcoin. Don't panic. Don't pay. Here's what actually works.

The fix: disconnect, scan, and restore

Pull the plug. Unplug the ethernet cable or turn off Wi-Fi immediately. This stops the ransomware from encrypting more files — especially network drives. On a laptop, close the lid to force sleep. Do not shut down normally — that can trigger more encryption.
Boot into Safe Mode with Networking. Hold Shift while clicking Restart. Go to Troubleshoot > Advanced Options > Startup Settings > Restart. Press 5 for Safe Mode with Networking. This loads only essential drivers, so the ransomware can't run.
Run a full scan with Malwarebytes. Download the free version (if you can get online). Run a Threat Scan. It will find the ransomware file — usually in %AppData% or %Temp% with a random name like javaw.exe or svchost.exe. Remove everything it finds. Then run a second scan with the Microsoft Safety Scanner to catch stragglers.
Check for a decryptor. Go to NoMoreRansom.org. Search for your extension (like .lockbit, .phobos, .stop). If you see a decryptor tool, download it and follow the instructions. For the StopDjvu variant (which adds .djvu to files), the Emsisoft decryptor works if the offline key was used.
Restore from backup. This is your best bet. If you have Windows File History turned on, go to Settings > Update & Security > Backup > Restore files from current backup. If you use cloud backup like OneDrive or Backblaze, check the version history — right-click the file and pick "Restore previous version."

Real case: A client called me after opening a "UPS delivery failed" email. The .js file inside launched StopDjvu ransomware. He didn't pay — we restored 90% of files from a 2-week-old external drive backup. He lost only the files changed in the last 14 days.

Cause 2: You enabled macros in a Word document attachment

Some ransomware doesn't run automatically. It hides inside a Word document with a message: "This document is protected. Click Enable Content to view." That's the trap. Once you enable macros, the ransomware downloads and runs.

The fix: remove the macro and clean up

Delete the malicious document. Right-click the .docm file and delete it. Empty the Recycle Bin.
Disable macros permanently. Open Word (or Excel). Go to File > Options > Trust Center > Trust Center Settings > Macro Settings. Select "Disable all macros with notification." This stops future attachments from running code without asking.
Run a macro-specific scan. Use the Microsoft Safety Scanner from the command line with the -m flag to scan for macro viruses. Open Command Prompt as admin and run:

msert.exe -m

This scans all Office files and removes embedded macros that are malicious.

Pro tip: If you already restored from backup, scan every restored file with Windows Defender. Right-click the folder and pick "Scan with Microsoft Defender." Old infections can hide inside Office documents.

Cause 3: The attachment was a password-protected ZIP file

Phishers know email scanners check attachments. So they send a ZIP file with a password in the email body: "Password: 1234" or "Password: Invoice." Inside is an .exe or .scr file that looks like a PDF. You unzip it, enter the password, run the file, and ransomware starts.

The fix: stop the infection from spreading

Disconnect from the network immediately. Same as above — unplug ethernet or turn off Wi-Fi. Ransomware in this category often tries to encrypt shared folders on the network first.
Kill the process using Task Manager. Press Ctrl+Shift+Esc. Look for a process with high CPU usage — usually named after the attachment (like invoice.exe or shipping.scr). Right-click and choose "End process."
Delete the extracted files. Navigate to the folder where you unzipped the attachment. Delete everything. Then empty the Recycle Bin.
Run a full scan with Kaspersky Virus Removal Tool. It's free and catches ransomware that other scanners miss. Download it from Kaspersky's site. Run a full scan. Let it remove threats.
If files are already encrypted, use the Shadow Copy restore method. Open Command Prompt as admin and run:

vssadmin list shadows

If you see any shadow copies listed, type:

copy \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy1\* C:\RecoveredFiles\

Replace HarddiskVolumeShadowCopy1 with the correct ID from the list. This copies previous versions of your files — often before encryption.

Real scenario: A small business owner extracted a ZIP from a "project quote" email. The .exe inside encrypted all .docx and .xlsx files. We used Shadow Copy to recover 85% of them. The rest came from a cloud backup.

Quick-reference summary table

Cause	Symptom	Best fix	Don't do
Fake invoice .docm or .js	Files renamed to .locked, .djvu	Disconnect, scan with Malwarebytes, restore from backup	Pay the ransom
Word macro in attachment	Document says "Enable Content"	Delete file, disable macros, scan with msert -m	Enable macros again
Password-protected ZIP with .exe	ZIP arrives with password in email	Kill process, delete extracted files, use Shadow Copy	Run the .exe

Look, I've been doing this for years. The ransomware guys make it look easy, but they're banking on you panicking. Don't pay — it funds more attacks. Instead, use this order: disconnect, scan, restore from backup. If you don't have a backup, try NoMoreRansom and Shadow Copy. And for next time? Turn on File History and never, ever click Enable Content on an email attachment.