My files all have a new extension and won't open - what should I do?

A changed extension alone is not proof. The more of these signs you see, the more certain it is ransomware:

• One extension everywhere. Word, Excel, images, archives and database files of different types all carry the same unfamiliar appended extension, usually with the original extension still visible before it, as in report.xlsx.unknown.
• An ID and an email address inside the file name, in the form originalname.[ID].[attacker email].extension. This is the signature format of families common in China such as Phobos and Makop; other families append only a random string.
• A new file in every folder, typically named with README, RECOVER, HELP, DECRYPT or info, in .txt, .hta or .html format, containing contact and payment instructions.
• A wallpaper replaced with a ransom message, or a pop-up after logon.
• Roughly the same size, but unreadable. In Notepad the file is solid gibberish with none of the original text visible; the size is the same or slightly larger, because some families append encrypted key data to the end of each file.
• Concentrated in time, wide in scope. Large numbers of files changed within the same window, and files on mapped shares, NAS and external drives changed as well.
• System-level damage. Previous versions (shadow copies) have all vanished, antivirus has been switched off, and database or backup services have stopped. CISA's advisory on Phobos, for example, records attackers deleting all shadow copies with vssadmin.

Keep two exceptions in mind: a few families do not rename files at all and leave only a note, and others replace the entire file name with random characters, which looks like garbled names. So the real test is not the extension but whether the content is encrypted and whether there is a ransom note.

These situations also make it look as if "the extensions changed and nothing opens", but the data is usually still there:

USB worms. Huorong's January 2026 guidance explains that these worms give files the system attribute, so ticking "show hidden items" is not enough to see them. Use your security software's USB repair function, or open Command Prompt as administrator, switch to the USB drive letter and run attrib -S -H /S /D to clear the system and hidden attributes.

Disk failure. Stop reading and writing immediately, do not format, do not keep re-plugging the device and do not run disk repair; image the media first and recover from the image - see our data recovery service.

If nothing in the table fits and several signs from the previous section do, treat it as ransomware.

The table only covers formats already documented in this site's family library and common in China. The note column matters: a judgement is only reliable when the extension and the note agree.

Two caveats. Attackers can change extensions and name formats at will, and one format can be shared - the Phobos format also appears with 8Base, and Makop is often mistaken for Phobos - so this table only points a direction. And an extension like .360 deliberately borrows a well-known vendor's name and has nothing to do with that company. More extensions can be looked up in the extension index.

Renaming does not undo encryption. Ransomware changes the content; the extension is just the mark it leaves. Rename report.xlsx.mkp back to report.xlsx and it still won't open, and Office may call it corrupted and nudge you towards "repair". Worse, the ID, email address and extension in the name are themselves the evidence for identifying the family and version, so batch-renaming wipes out clues. Some families even store the encrypted original path at the end of the file, and ad hoc renaming only makes later reconciliation harder.

Unknown repair tools are riskier still. Programs circulating as "ransomware decryptors" or "extension repair" include a great deal of malware that can encrypt again or steal data; even a genuine decryptor can corrupt files from a mismatched version; and any tool running on the original disk writes to it, overwriting remnants that might still have been recoverable. Legitimate free decryptors come only from law enforcement and security vendors, and all of them require the family and version to be confirmed first - see ransomware decryption tools.

Be careful with the note too. An .hta file is not a web page but an application run by the Windows component mshta; CISA's Phobos advisory records attackers using mshta to launch the info.hta ransom page. Reading it in Notepad is all you need.

For the same reason, hold off on disk checks, System Restore and one-click restores of previous versions: they all write to the original disk. If you do need them, work on a copy.

Once confirmed, follow the full response in what to do if you've been hit by ransomware: isolate, preserve evidence, identify the family, assess recovery paths, report, and harden before reconnecting. A few reminders:

• On a personal PC, infections mostly come from cracked software, activation tools and game cheats, and STOP/Djvu is the usual culprit. K7 Labs documented it downloading the Vidar stealer before encrypting, taking saved browser credentials, cookies and cryptocurrency wallets - so change important passwords from a different, clean device.
• A work computer that can reach file shares, NAS or servers makes this an organisational incident; the machine that was noticed is rarely the only one hit.
• Recoverability depends on the family, the version and the backups, not on paying. For an honest assessment see can encrypted files be recovered.
• Send us the extension and a screenshot of the note, and the first read on the family and viable recovery paths is free.