# Can we keep using our computers after a ransomware attack?

Usually the hardware, yes, but not the installation. Ransomware and the tools that come with it change the operating system, add accounts and leave persistence that is hard to find, so the reliable approach is to wipe and reinstall affected machines from known-good images, then restore data from a backup taken before the intrusion. Keep the disks, or images of them, of machines needed for the investigation before you reuse them. Infections at firmware level exist but are rare; your responder will say if there is a reason to replace hardware. Unaffected machines still need checking, because attackers often touch more systems than they encrypt. Before reconnecting rebuilt machines, make sure the way in is closed. The NetSenX network map shows which hosts talked to the affected ones during the incident, which helps you decide what else to check.

FAQ: [Incident response](https://netsenx.com/en/faq/incident) · https://netsenx.com/en/faq/can-we-keep-using-computers-after-ransomware

## Read next

- https://netsenx.com/en/detect-ransomware-on-the-network
- https://netsenx.com/en/nis2-incident-reporting-deadlines

## Related questions

- [How do we recover safely after a cyber incident?](https://netsenx.com/en/faq/how-to-recover-safely-after-a-cyber-incident)
- [Can we keep working during a cyber incident?](https://netsenx.com/en/faq/can-we-keep-working-during-a-cyber-incident)
- [How long should we watch the network closely after an incident?](https://netsenx.com/en/faq/how-long-to-watch-the-network-after-an-incident)
- [What is a lessons-learned review after an incident?](https://netsenx.com/en/faq/what-is-a-lessons-learned-review-after-an-incident)
- [What do we do with a security alert at night when nobody is on call?](https://netsenx.com/en/faq/a-security-alert-at-night-and-nobody-on-call)