Thomas KC IT guide
After you notice an infection, stop using that PC for banking and email, avoid the phone number on any pop-up, and make a list of accounts you typed passwords into recently. Cleanup comes next. Password changes belong after the PC is trustworthy again, starting with email.
Disconnect from advice that arrives inside the scare screen. If someone already had remote access, assume extra software may remain even after the pop-ups disappear.
If files are encrypted and a note demands payment, do not pay from the infected machine and do not expect Thomas KC IT to negotiate. That is a different kind of incident. We can still talk about whether the PC can be rebuilt and what backups you have.
Email is the master key because it can reset other accounts. Change it from a different device after the infected PC is cleaned or replaced. Then change banking, shopping, and work accounts you used on that computer.
Turn on multi-factor authentication where the service offers it. A cleanup that leaves the same reused password in place is incomplete.
A hijacked browser can often be repaired. A PC that will not finish booting, or one that had an unknown person controlling it, is a better candidate for a clean install once files are copied.
Kansas City customers can request that decision through malware removal. Say whether you have a backup before the appointment so nobody is surprised by a wipe.
Change them from a different phone or computer. Changing them on the infected PC can hand the new password to whatever is still running.
A scan helps and is not always enough. Extensions, scheduled tasks, and a damaged Windows install can remain. Someone still has to check the result and decide if a reinstall is wiser.
Thomas KC IT serves the Kansas City, Missouri metro. This guide is background. The linked service page is where the job is scoped.
Request service Back to Thomas KC IT