{"id":4196,"date":"2026-06-08T18:00:18","date_gmt":"2026-06-08T15:00:18","guid":{"rendered":"https:\/\/support.withsecure.com\/en\/?post_type=support_article&#038;p=4196"},"modified":"2026-06-08T18:00:18","modified_gmt":"2026-06-08T15:00:18","slug":"infected-by-ransomware","status":"publish","type":"support_article","link":"https:\/\/support.withsecure.com\/jp-ja\/support-articles\/infected-by-ransomware\/","title":{"rendered":"Infected by ransomware"},"content":{"rendered":"<h3>Issue:<\/h3>\n<p>A workstation&#39;s or server&#39;s files have been encrypted by ransomware. How do I decrypt them and get access back to my files?<\/p>\n<h3>Resolution:<\/h3>\n<p>A ransomware infection typically distributed through a few ways such as phishing email (common way to infect), infected USB drive, unsecured public Wi-Fi networks, exploitation of zero-day vulnerabilities, pirated software, and covert drive-by downloads from a malicious website.<\/p>\n<p>We recommend having both DeepGuard and DataGuard security features enabled for protection against traditional and modern ransomware attack.\u00a0<\/p>\n<p>For ransomware attack assistance, we suggest you to contact our Emergency Incident Response team on this page.<\/p>\n<p><a href=\"https:\/\/www.withsecure.com\/en\/about-us\/company-contacts\/24-7-incident-hotline\" target=\"_blank\" rel=\"noopener\">https:\/\/www.withsecure.com\/en\/about-us\/company-contacts\/24-7-incident-hotline<\/a><\/p>\n<p>To help us investigate the issue further, please provide the following information:<\/p>\n<ol>\n<li><strong>Detailed Description and timeline of the event<\/strong>\u00a0[When did this exactly happened?]<\/li>\n<li><strong>Sample<\/strong>\u00a0[Please provide us the sample of the suspicious file. Without this sample, we won\u2019t be able to investigate the request further.]<\/li>\n<li><strong>WSDIAG<\/strong>\u00a0[End-Point logs] depending from the OS version:\n<ul>\n<li>Windows:\u00a0<a href=\"https:\/\/community.withsecure.com\/en\/kb\/articles\/31193-how-to-create-or-generate-a-wsdiag-diagnostics-file-on-a-windows-computer\" target=\"_blank\" rel=\"noopener\">https:\/\/community.withsecure.com\/en\/kb\/articles\/31193-how-to-create-or-generate-a-wsdiag-diagnostics-file-on-a-windows-computer<\/a><\/li>\n<li>Mac:<a href=\"https:\/\/community.withsecure.com\/en\/kb\/articles\/31222-how-do-i-generate-wsdiag-diagnostic-logs-on-withsecure-mac-products\" target=\"_blank\" rel=\"noopener\">https:\/\/community.withsecure.com\/en\/kb\/articles\/31222-how-do-i-generate-wsdiag-diagnostic-logs-on-withsecure-mac-products<\/a><\/li>\n<li>Linux:<a href=\"https:\/\/community.withsecure.com\/en\/kb\/articles\/31376-can-withsecure-endpoint-protection-clients-detect-malware-for-linux\" target=\"_blank\" rel=\"noopener\">https:\/\/community.withsecure.com\/en\/kb\/articles\/31376-can-withsecure-endpoint-protection-clients-detect-malware-for-linux<\/a><\/li>\n<\/ul>\n<\/li>\n<li><strong>Autoruns<\/strong>\n<ol>\n<li>Download the tool <a href=\"http:\/\/from https:\/\/docs.microsoft.com\/en-us\/sysinternals\/downloads\/autoruns\" target=\"_blank\">from https:\/\/docs.microsoft.com\/en-us\/sysinternals\/downloads\/autoruns<\/a><\/li>\n<li>Please remember to enable the &quot;Hide Signed Microsoft Entries&quot; setting.<\/li>\n<li>Save the log file created as an .arn file to your Desktop.<\/li>\n<\/ol>\n<\/li>\n<li><strong>Process Explorer<\/strong>\n<ol>\n<li>Download tool from <a href=\"http:\/\/technet.microsoft.com\/en-us\/sysinternals\/bb896653.aspx\" target=\"_blank\" rel=\"noopener\">http:\/\/technet.microsoft.com\/en-us\/sysinternals\/bb896653.aspx<\/a> and extract the zip file.<\/li>\n<li>Run procexp.exe with administrator privileges.<\/li>\n<li>Click on <strong>File<\/strong> &gt; <strong>Save<\/strong> and save the file as &quot;procexp.txt&quot; in your desktop.<\/li>\n<\/ol>\n<\/li>\n<li>After generating the logs, please upload them via\u00a0<strong>FTP<\/strong>\u00a0as follows:\n<ol>\n<li>Rename the WSdiag.zip file on your desktop.<\/li>\n<li>Right-click on the file and select Rename\u00a0<strong>[Your case number here]<\/strong>\u00a0_WSdiag.zip.Right-click the\u00a0<\/li>\n<li>Windows Start icon and select\u00a0<strong>Open<\/strong>\u00a0Windows Explorer. A Windows Explorer window opens.<\/li>\n<li>Type\u00a0<strong>ftp:\/\/ftp.withsecure.com\/incoming<\/strong>\u00a0in the address bar, and press Enter. Note: After uploading the file, the file is no longer visible.&#39;<\/li>\n<li>Please reply to the incident case\u00a0inform us that you have now uploaded the Wsdiag file.<\/li>\n<\/ol>\n<\/li>\n<\/ol>\n","protected":false},"excerpt":{"rendered":"<p>A guideline on how to proceed if a computer has been infected and encrypted by ransomware.<\/p>\n","protected":false},"template":"","support_article_product":[104],"class_list":["post-4196","support_article","type-support_article","status-publish","hentry"],"acf":{"source_foreign_id":"000014088","source_version":3,"source_system":"salesforce","source_date_updated":"2026-06-08 15:00:18","import_hash":"6453967db5a23a4c5e1a1c0755e7ecedbaf63dbd","vanilla_article_id":29657,"vanilla_url":"https:\/\/community.withsecure.com\/en\/kb\/articles\/29657-infected-by-ransomware","vanilla_kb_id":30,"vanilla_category_id":106,"machine_translated":false,"reactions_helpful_yes":0,"reactions_helpful_no":0},"_links":{"self":[{"href":"https:\/\/support.withsecure.com\/jp-ja\/wp-json\/wp\/v2\/support_article\/4196","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/support.withsecure.com\/jp-ja\/wp-json\/wp\/v2\/support_article"}],"about":[{"href":"https:\/\/support.withsecure.com\/jp-ja\/wp-json\/wp\/v2\/types\/support_article"}],"wp:attachment":[{"href":"https:\/\/support.withsecure.com\/jp-ja\/wp-json\/wp\/v2\/media?parent=4196"}],"wp:term":[{"taxonomy":"support_article_product","embeddable":true,"href":"https:\/\/support.withsecure.com\/jp-ja\/wp-json\/wp\/v2\/support_article_product?post=4196"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}