Suspected Virus or Ransomware — Immediate Steps

Category: Cybersecurity · Audience: Customers & Technicians · Est. time: Act now

🚨 If files are being encrypted, you see a ransom note, or files are renamed with a strange extension — act immediately. Speed limits the damage.

Summary

Ransomware and serious infections spread across the network and to cloud storage. The priority is to isolate the device and call BBN, not to investigate it yourself.

Do this now (in order)

1. Disconnect the device from the network — do NOT shut it down.

• Unplug the Ethernet cable and turn off Wi‑Fi (Airplane mode).
• Leaving it powered on preserves evidence and memory that helps recovery; pulling the network stops it spreading.

1. Call BBN Support immediately. Phone is faster than email for an active incident. Tell us: which device, what you saw (ransom note? files renamed?), and what you clicked/opened just before.
2. Isolate other affected machines. If shared drives or other PCs show encrypted/renamed files, disconnect those from the network too.
3. Do not pay any ransom and do not run random "removal tools" — this can destroy recovery options.
4. Change your passwords from a *different, clean* device (phone or another PC) — especially email and any saved credentials.

What NOT to do

• ❌ Don't shut down or restart the infected PC (unless BBN tells you to).
• ❌ Don't plug USB drives into it or copy files off it.
• ❌ Don't delete the ransom note or files — they help identify the strain.
• ❌ Don't reconnect it to the network to "test" it.

What BBN will do

• Contain the incident, identify the strain, and assess the spread.
• Restore clean data from the BBN backups (versioned, off‑device copies) once the environment is safe.
• Review how it got in and close the gap.

Prevention

• Keep MFA on, be cautious with email links/attachments (see the phishing article), keep systems patched, and ensure BBN backups are running — that backup is what makes recovery possible.