My Business Computer Is Infected: What to Do in the First Hour

Disclosure: This article contains an affiliate link to Malwarebytes Premium, a product we recommend and install. If you buy through that link, PC Net, Inc. earns a commission at no extra cost to you. It never changes what we recommend — we only link to what we would put on a customer’s computer ourselves.

For illustration only.

A business computer infection rarely announces itself politely. It starts small — a pop-up that won’t close, a browser landing on strange pages, a machine that was fine yesterday and crawls today. What you do in the next sixty minutes decides whether this stays a one-computer cleanup or becomes your whole office, your email, and your customer data.

When a business computer is infected, the first hour decides the damage. We clean infected computers for Miami businesses every week, and the pattern is consistent: the customers who lose the least are the ones who did the first three things on this list quickly — and avoided the mistakes that make an infection worse. Here is the sequence, in order.

In this guide:

1. The signs it is really an infection (and not just a slow computer)
2. Minutes 0–10: disconnect it from everything
3. What not to do — the mistakes that spread the damage
4. Minutes 10–30: protect your accounts from a clean device
5. Minutes 30–60: cleanup, or wipe and rebuild? How to decide
6. After it is clean: the protection we recommend
7. Frequently asked questions

The signs it is really an infection (and not just a slow computer)

Look for the signs that separate an infection from a merely aging machine:

• Pop-ups claiming your computer is infected, especially ones with a phone number to call or a countdown timer. Real protection software never asks you to call a number.
• Your browser goes where it wants — homepage changed, searches redirect to unfamiliar sites, new toolbars or extensions you never installed.
• Programs appear that nobody installed, or your security software is suddenly disabled and won’t turn back on.
• Files have strange new extensions or won’t open, possibly with a note demanding payment. That is ransomware — skip straight to disconnecting and calling a professional.
• People tell you they received odd emails from your address that you never sent.

One or two of these together almost always means something malicious is running. Treat it as an infection and start the clock.

For illustration only.

Minutes 0–10: disconnect it from everything

The single most valuable action costs nothing and takes ten seconds: take the computer off the network. Pull the ethernet cable, or turn off Wi-Fi. Most modern malware needs that connection — to spread to the other computers in your office, to send your data out, or to receive instructions. A disconnected machine is an infection in a box instead of an infection on the move.

While you are there:

• Unplug external drives and USB sticks so the infection cannot reach them.
• Take a photo of any message on the screen with your phone. Exact wording and error codes tell a technician a great deal, and the screen may not show it again.
• Write down what happened just before it started — an attachment opened, an invoice downloaded, a website visited. That timeline is gold during diagnosis.
• Do not keep “testing” it. Every reboot and login attempt is another chance for the malware to dig in or phone home.

Then leave it alone and move to a clean computer or your phone.

What not to do — the mistakes that spread the damage

Good intentions cause half the damage we see. Avoid these:

• Never call the number on a virus pop-up. That is the scam itself: a fake support agent who asks for remote access and a credit card, and leaves the computer worse than he found it. We recently documented a real case of unauthorized remote-access software on a business computer — it starts exactly this way.
• Never pay a ransom. Payment does not guarantee your files come back, and it marks your business as one that pays. Talk to a professional first.
• Do not plug in your backup drive “to check it.” If the infection is ransomware, a connected backup gets encrypted too. Your backup is only safe while it stays disconnected.
• Do not download the “removal tool” the pop-up offers, and do not type any password on the infected machine — keyloggers are common, and every password typed is a password handed over.

Minutes 10–30: protect your accounts from a clean device

An infected computer is a hardware problem. Your accounts are the bigger prize, and they can be defended right now — from a different, clean device, never from the infected one.

1. Change your email password first. Email is the master key: whoever controls it can reset almost every other password you own.
2. Turn on two-factor authentication for that email account while you are in there. This one step blocks most account takeovers even if a password leaked.
3. Then banking and accounting — bank, accounting login, payroll, and Microsoft 365 or Google Workspace.
4. Warn your contacts if strange email went out from your address. One short message — “my computer was infected, don’t open attachments from me today” — stops the infection from using your reputation to spread.

For illustration only.

Minutes 30–60: cleanup, or wipe and rebuild? How to decide

With the machine isolated and your accounts secured, the remaining decision is how the computer gets clean. There are two honest paths, and choosing wrong wastes either time or data.

A guided cleanup can be enough when the problem is adware or a browser hijacker — pop-ups and redirects, no encrypted files, no sign of stolen passwords, and the machine scans clean twice with zero findings.

Wipe and rebuild is the safer call when files are encrypted or renamed, malware returns after removal, security software can’t be re-enabled, or the computer holds sensitive customer or payroll data. Rebuilding from a known-clean state, restoring files from your disconnected backup, is slower — but it is the only way to know the machine is clean rather than hope it is.

For a business machine — especially one that touches customer data — this is where professional cleanup earns its cost. At our shop it starts with a $35 diagnostic, so you know which path the machine needs before you pay for either one. You can hand us the whole problem through our computer repair service in Miami, in-shop or on-site.

For illustration only.

After it is clean: the protection we recommend

Cleanup fixes yesterday’s infection. Protection is what makes this a one-time story. Three layers do most of the work: keep Windows and your browser updated, keep a backup that is not permanently connected, and run real-time protection on every machine — not just the one that got infected.

The protection we recommend and install after a cleanup is Malwarebytes Premium. It blocks malware, scams, and malicious sites in real time — on PCs, Macs, and phones — and it is built to catch exactly the pop-up scams and malicious downloads that start most of the infections we clean. It runs alongside the protection already in Windows rather than fighting it.

For offices that would rather not manage this per-computer, that same layered protection — endpoint security, patching, monitoring — is what our Managed IT services in Miami include. Either way, the rule holds: protection installed on a calm Tuesday costs a fraction of cleanup on a panicked Friday.

For more depth, the U.S. Cybersecurity and Infrastructure Security Agency publishes a plain-language prevention guide worth bookmarking: CISA Stop Ransomware Guide.

Frequently asked questions

PC Net, Inc. is an independent computer and printer repair company in Miami, FL, serving Miami-Dade businesses since 1998. Malwarebytes is a trademark of Malwarebytes Inc. This guide reflects our shop’s experience and is not published or endorsed by Malwarebytes Inc.