My machine has a virus or ransomware — what is the first step?

Why disconnecting comes first: ransomware looks for shared drives and other machines on the same network and encrypts them too. One infected machine attached to an office network can turn a single-device problem into a total outage within minutes. Pull the cable or switch off Wi-Fi before thinking about any fix — the order here determines the size of the loss.

And three mistakes that increase the loss: repeated rebooting (some strains continue encrypting on each boot), attaching the backup drive to the infected machine so it is encrypted too and you lose your last line of defence, and paying the ransom — which guarantees nothing and confirms to the attacker that you are a profitable target. Keep the ransom note text and photograph the screen: some strains have free published decryption tools, and identifying the strain is the real first step.

And once contained, the important question: how did it get in? The commonest routes are an email attachment, software downloaded from an unofficial source, or a remote-desktop service exposed to the internet behind a weak password. Fixing the entry point matters more than cleaning the machine — cleaning without closing the door means the incident repeats.

• Disconnect from the network immediately — before anything else
• Do not attach the backup drive to the infected machine
• Do not pay the ransom and do not keep rebooting
• Keep the note text — some strains have free decryption tools
• Fix the entry point, not just the machine, or it recurs