brandMy business computers have a virus. What do I do right now?
- Disconnect the affected computer from the network. Unplug the cable and turn off Wi-Fi. Do not shut it down if you can avoid it; evidence in memory can help.
- Do not pay any ransom demand or call a phone number shown in a pop-up.
- Change passwords for email and banking from a different, clean device.
- Call us — no contract needed for emergency IT support. The sooner we contain it, the less spreads to other machines, shared drives and backups.
- Notify your cyber-insurance carrier if you have one; many require prompt notice and have approved response procedures.
Signs of a ransomware attack on a small business
Ransomware rarely arrives without warning. Watch for files that suddenly will not open or have strange extensions, a ransom note on screen or in folders, antivirus being disabled, unusual sign-ins to email from other countries, new administrator accounts nobody created, and a sudden spike in network activity overnight. Any one of these is worth a call.
Removing it is half the job
After cleanup we find out how it got in, whether that was a phishing email, an unpatched device, a reused password or remote access left open, and fix it. Most clients then add email security, endpoint detection and response, and immutable backups so a repeat is far less likely.
Signs it’s time for Virus & Malware Removal
- Pop-ups, new toolbars or a browser that redirects on its own.
- Files that will not open or have strange extensions.
- A ransom note on screen or in folders.
- Antivirus disabled without anyone doing it.
- Contacts receiving emails you did not send.
If two or more of these sound familiar, take the free security check or book a free cybersecurity assessment.
How our Virus & Malware Removal process works
Contain
Isolate infected devices and disable compromised accounts.
Investigate
Identify the threat, how it got in and what it touched.
Eradicate & restore
Remove the malware and restore clean data from backup.
Harden
Close the gap and add protections so it does not happen again.
What’s included
- Emergency containment and device isolation
- Malware, ransomware and adware removal
- Compromised account and credential review
- Clean restore from backup
- Root-cause report and remediation plan
- Coordination with cyber-insurance carriers
Who it’s for
- Businesses with an active infection or ransom note
- Offices with a compromised email account
- Companies needing incident documentation for insurers
- Anyone who clicked something suspicious
What affects the price
Every quote is flat and in writing. These are the factors that move the number:
| Factor | Why it matters |
|---|---|
| Scope of infection | One computer versus several devices, servers or shared drives. |
| Backup availability | Clean backups make recovery much faster. |
| Account compromise | Email and cloud account cleanup adds investigation time. |
| Urgency | After-hours emergency response may carry a premium. |
Fast response across Eagle County
When minutes matter, remote containment starts as soon as you call, from Vail to Gypsum. If a device needs hands-on work, we come to you or have it dropped off in Edwards.
“Todd has helped get our team protected at a level we had no idea existed. As an Insurance Agency, we know the importance of protecting our clients data, Todd has taken that to a new level!”
Frequently asked questions
My business computers have a virus. What do I do?
Disconnect the affected computer from the network, do not pay any ransom or call numbers in pop-ups, change critical passwords from a clean device, and call a business IT provider immediately. Vail Valley IT handles business malware response at (970) 446-9440.
What are the signs of a ransomware attack on a small business?
Files that will not open or have unusual extensions, ransom notes, disabled antivirus, unexpected sign-ins or new admin accounts, and unusual overnight network activity.
Can you recover files encrypted by ransomware?
Usually from a clean backup. That is why immutable, offsite backups matter. Paying a ransom does not guarantee recovery and may create legal and insurance complications.
Should I pay the ransom?
Talk to your IT provider and cyber-insurance carrier first. Paying does not guarantee recovery, may fund further attacks and can create legal and insurance complications. Clean backups are the reliable path back.