The first step after a system is infected with ransomware malicious software is to disconnect the infected device from the network and turn off its Internet connection. If there is any connected external hard drive to the infection device, remove it and check it for encrypted data.