Skip to main content
GDMME
繁中简中EN
Enquire
Public tool · No sign-in · Local processing

Files will not open?
Start with the clues

Review symptoms, ransom-note clues and file characteristics to understand what needs attention. Analysis runs in your browser.

Suspect ransomware? Stay calm and follow these 3 steps

  1. Stay calm and pause

    Stop using the affected device. Do not rush to pay, reply to ransom messages or follow links in the note. Do not download decryptors or cleanup tools on your own.

  2. Disconnect to limit spread

    If safe to do so, unplug the affected computer’s network cable, turn off Wi-Fi and disconnect external storage. Ask your IT lead to coordinate isolation of servers and critical systems.

  3. Preserve evidence and get help

    Record when you noticed the issue and photograph the screen. Preserve notes, original files and logs. Avoid restarting, reinstalling or cleaning up on your own. Use a known-safe device or phone to contact your IT lead or GDMME for guidance on next steps.

Respond to the incident first, then review the clues. Do not move suspicious files to another computer.

Contact GDMME for guidance on next steps

Use only data you are authorised to inspect. Files and notes are not uploaded to GDMME or third parties, or added to enquiry messages.

If you suspect an incident now, contact your IT lead first. Do not open or execute suspicious files on another computer just to use this tool.

01 / What you have observed

Select what you know. Leave unknown items as “Not sure”.

02 / File characteristics (optional)

Up to 10 MiB. Reads bytes and calculates SHA-256 without execution, extraction or content preview.

03 / Ransom note (optional)

Up to 20,000 characters. Counts payment, decryption, deadline and data-leak cues without opening embedded links.

Browser support check

OFFICIAL GUIDANCE / NEXT STEPS

Preserve clues, then arrange a response

Enquire about incident support
  1. 01

    Limit connections

    If infection is suspected, follow your IT lead’s directions to isolate affected devices from networks and external storage to limit spread.

  2. 02

    Preserve evidence

    Record times, screens and affected systems. Retain original files and logs; do not reinstall systems or alter evidence on your own.

  3. 03

    Contact the responsible team

    Ask IT or your incident team to review impact, backups and recovery. If personal data is involved, assess the breach and notification needs too.

Tool and privacy information

This page uses fixed rules and file characteristics, without an AI API. Inputs are held temporarily in page memory; clear them at any time. Results are not retained after reloading.

Normal page visits may produce server access logs. This tool does not write files or notes to the server, browser storage or enquiry forms.

Local processing reduces data transmission; it is not legal or regulatory certification.

Read the privacy notice