# How to tell ransomware is encrypting your files — the early signs | Rain Cleaner > The signs that appear before the ransom note: shadow copies disappearing, files losing their format signature, a sudden entropy jump, BitLocker being turned on for you. What to do in the first minute. - Product: Rain Cleaner 2.7.1 — Cleans, explains, hides nothing. - Publisher: T. Vasilev - Platform: Windows 10, Windows 11, Windows Server - Price: 0 EUR (Pro not on sale yet) - Download: https://raincleaner.eu/download · Portable: https://raincleaner.eu/download/portable - Canonical: https://raincleaner.eu/guides/ransomware-warning-signs ## How to tell ransomware is encrypting your files By the time there is a ransom note on the desktop, the work is finished. The useful signs come earlier, and most of them are visible without any special tool. ### The early signs, in the order they usually appear Encryption is loud if you know what to listen for. Before anything is announced, the machine does a set of things that are unusual on their own and damning together. One of these alone can have an innocent explanation. A backup program touches many files. An installer runs an encoded command. Two or three of them within the same minute do not have an innocent explanation. - Shadow copies and the backup catalogue are deleted — this is the step that removes your way back. - The disk works hard with no program open that would explain it. - Files keep their names but no longer open, or gain an extension you have never seen. - A text file appears in several folders at once with the same name. - BitLocker suddenly wants to encrypt a drive you did not ask it to encrypt. ### Why a file that is encrypted stops looking like itself Almost every file format starts with a fixed signature — a Word document begins with PK, a PDF with %PDF, a PNG with its own eight bytes. Encryption replaces the whole file, so that signature goes with it. There is a second measurement that pairs with it. Randomness in a file can be scored, and ordinary content scores low: plain prose sits around 4.2 bits per byte, and already-compressed formats like JPEG or ZIP sit between 5 and 7. Encrypted data sits above 7.5, because that is what encryption is for. Neither measure means much on its own — a ZIP is legitimately high, and a broken file is legitimately headerless. A file that has lost its signature and gained randomness has been rewritten. ### What to do in the first minute Order matters more than speed here, and the instinct most people have — start opening files to see how bad it is — is the wrong one. Do not pay before talking to someone who has handled a case. Do not reinstall Windows over the disk: it destroys the evidence and sometimes the only copy of the key material. - Disconnect the network — cable out, Wi-Fi off. Shared drives are how one machine becomes ten. - Do not reboot. Some keys live only in memory, and a restart throws them away. - Photograph the ransom note and the extension with your phone; identification depends on both. - Leave the encrypted files where they are. Free decryptors exist for some families, and they need the originals. ### What a user-mode program can honestly do about it This is where most security marketing stops being true, so here is the limit stated plainly. A program without a kernel driver cannot stand between another program and the disk. It cannot be a wall. What it can be is a tripwire and a witness. Rain Cleaner writes decoy files into the folders that matter — three per folder, named so that one of them sits near the front of any alphabetical listing, one in the middle and one at the end, because a program encrypting a folder walks it in order. It scores what it sees on a scale where a suspicious command shape can raise an alarm but only a completed act — shadow copies deleted, a decoy rewritten, a security service killed — can stop a program. And it writes a journal where each line carries the hash of the line before it, so that a deleted line becomes a visible hole instead of a clean escape. ### The BitLocker variant nobody expects Some attacks bring no encryption of their own. They turn on BitLocker with a key you never see, remove yours, and leave. Your data is encrypted with a Microsoft feature that is working exactly as designed. Windows records this: event 773 when a protector is suspended and 776 when one is removed. If BitLocker was never something you set up, either of those in your event log is worth an immediate look. ### Quick questions **Will antivirus catch it?** Often, and it should be your first line. But the families that actually make the news in 2026 are the ones that arrive carrying a signed but vulnerable driver specifically to switch the antivirus off from underneath. That is why a second, independent witness has value. **Are decoy files not easy to avoid?** For an attacker who knows the exact names, yes. That is why placement matters more than secrecy: a program that walks a folder in order meets a decoy among the first files it touches, whatever it intends. **Can I get my files back without paying?** Sometimes. Check whether shadow copies survived, check the No More Ransom project for a decryptor for that family, and check any backup that was not mounted at the time. Keep the encrypted files either way. --- Other languages: [English](https://raincleaner.eu/guides/ransomware-warning-signs) · [Български](https://raincleaner.eu/bg/guides/ransomware-warning-signs) · [Deutsch](https://raincleaner.eu/de/guides/ransomware-warning-signs) · [Español](https://raincleaner.eu/es/guides/ransomware-warning-signs) · [Русский](https://raincleaner.eu/ru/guides/ransomware-warning-signs) · [Türkçe](https://raincleaner.eu/tr/guides/ransomware-warning-signs)