Short answer: disconnect that machine from the network first, before you investigate anything. An infected machine on a shared network is not one problem; it is a delivery mechanism.
The first hour, in order
- Disconnect it. Unplug the network cable, switch off Wi-Fi, and if it is on a shared drive, tell people to stop using that share for now.
- Leave it powered on. Do not shut it down. Running processes and logged-in sessions are evidence, and some malware finishes its work at shutdown.
- Ask three questions of the person who uses it: when did it start, what did they click or install just before, and is anything on that machine used by other people — shared folders, saved passwords, a mail client that everyone reads.
- Change the passwords that machine could reach, from a different device: shared mailbox, file share, accounting or banking portal, and any admin account that was used there.
- Check who else is showing symptoms. If a second machine behaves the same way, you are past the “one laptop” stage and should treat the network as exposed.
Why isolation comes before investigation
Because the most common small-office incident is not the first infection — it is the second one. Ransomware reaches file shares, spreadsheets reach everyone, and a shared mailbox password means every message is readable. Pulling the cable costs one person an hour. Not pulling it can cost the company its data.
What not to do
- Do not run three cleaners at once. You will not know what worked, and you may destroy the evidence that says what happened.
- Do not reinstall Windows yet. Copy what matters first, and identify the problem while it is still identifiable.
- Do not “just change the password” and keep using the machine. If the password was captured by something still running, changing it changes nothing.
- Do not plug in the backup drive. Connected backups get encrypted along with everything else.
What good looks like afterwards
- The machine was imaged before anything was changed.
- You know what it was, not just that it is gone.
- The accounts it could reach were reset, with two-factor turned on where it was missing.
- The way in is closed: updates applied, the shared folder reviewed, and the “we all use the same login” habit addressed.
- Someone wrote down what happened, because the second incident is always easier to handle with the first one documented.
Questions people ask
Can we keep working while it is checked? Everyone else can, on the condition that the infected machine is off the network and any shared credentials it used are changed. If it had access to the file server, assume the file server is in scope until checked.
Do we need to tell anyone? If client or personal data may have been accessed, there may be a reporting duty. That is a decision for whoever owns the business risk — but it should be made deliberately, in the first day, not discovered in the third week.
How do we stop this recurring? The usual answer is unglamorous: updates applied within days rather than months, separate accounts instead of one shared login, two-factor on mail and remote access, and a backup that is disconnected from the network most of the time.