Virus or ransomware?
First, disconnect.
Virus removal and ransomware response for businesses and the self-employed in Marbella and the Costa del Sol.
If a computer is behaving strangely or files have stopped opening, what you do in the first hour matters more than everything that follows. These are the first steps:
- Disconnect the affected computer from the network: unplug the cable and turn off the WiFi. If it looks like ransomware, avoid shutting it down or restarting it if you can, because information that helps establish what happened is lost. If you cannot disconnect it and you can see it is still encrypting, shut it down.
- Do not pay the ransom or reply to whoever is demanding it.
- Do not delete anything: not the encrypted files, not the ransom note, not the suspicious emails. They are the evidence and, sometimes, the lead.
- Change your passwords from another, clean computer, starting with email and the bank. Never from the affected computer.
- Tell people: whoever looks after your IT and the rest of the team, so that nobody connects anything else or opens the same email.
What is included
What we do once it has happened
This page is for when the problem is already inside. If what you want is to stop it arriving, that is the cybersecurity part of our IT consultancy: a review and a plan before the attack.
Isolating what is affected
We identify which computers, servers and accounts have been compromised and separate them from the rest so that it does not spread.Cleaning and reinstalling devices
If it is minor, the device is cleaned and checked. If there is any doubt about what has been left behind, it is reinstalled from scratch, which is the only thing that gives real peace of mind.Recovery from backups
We check which backups exist, whether the attack reached them and from what date you can restore. Without a safe backup, what has been encrypted may not be recoverable, and we will tell you so plainly.Establishing how they got in
An email with an attachment, a stolen password, an open remote access point, a program left unpatched. If the entry point is not found, they come back in the same way.Closing the door
New passwords, multi-factor authentication on email and remote access, outstanding patches applied and accounts that are no longer needed disabled.Breach notification
If personal data is affected, we help you gather what the Spanish Data Protection Agency (AEPD) requires: what happened, which data, how many people and what measures have been taken. The decision to notify, and the signature, belong to the data controller.Prevention afterwards
Once everything is working again, whatever failed becomes a list of measures so that it does not happen again.
Warning signs
How to tell if it has happened to you
Files have an odd extension and will not open
Documents and photos with altered names that no program recognises. This is the classic sign of ransomware.
A note appears demanding payment
A text file in every folder, or a new desktop background, with instructions and a deadline. Do not respond.
The computer is slow and windows keep popping up
Adverts, ‘your computer is infected’ warnings asking you to call a number or install something, programs you do not remember installing.
Your email is sending things you did not write
Clients asking about a message or an invoice you never sent. Someone has your password, or there are new rules in your mailbox.
Our approach
Contain, recover, close
01
Contain
Over the phone, we guide you through isolating what is affected. Then we assess the scope, remotely or at your office.
02
Recover
Computers cleaned or reinstalled, and data restored from the most recent good backup, if there is one.
03
Close and document
We close the way in and give you a written account of what happened, what was done and what remains outstanding.
Frequently asked questions
Virus and ransomware in Marbella
Should I pay the ransom?
We do not recommend it. Paying does not guarantee that you will receive the key, or that the key will work; it does not stop them publishing or selling what they have taken; and it marks you out as someone who pays. Before even considering it, you need to establish what backups exist.
Can I remove the virus myself with antivirus software?
Sometimes that is enough, if it is something minor on a single computer. But an antivirus that reports ‘clean’ does not tell you how it got in, or whether passwords have been taken. If the computer is used for work involving client data or the bank, the prudent course is to have it checked thoroughly or reinstalled.
Do I have to notify anyone?
If personal data is affected, Article 33 of the GDPR requires the breach to be notified to the Spanish Data Protection Agency (AEPD) within 72 hours of becoming aware of it, unless it is unlikely to result in a risk to individuals. You can also call INCIBE's free cybersecurity helpline, 017, and report the incident to the Policía Nacional or Guardia Civil.
Can encrypted files be recovered?
If there is a backup the attack did not reach, yes: the files are restored from it. Without a safe backup, the honest answer is that they may not be recoverable. We check what exists before promising anything.
Do you work with private individuals?
No. The service is for businesses and the self-employed. If it is a home computer, INCIBE's 017 helpline also assists members of the public and will advise you free of charge.
Think it has happened to you?
Tell us what you can see on screen and what is affected. We will tell you what to do now, and what we can do for you.
Related: Backup · IT consultancy and cybersecurity