Computer virus removal in Louisville, KY

Choose help that matches the incident

Describe the warning you saw, whether files open, which devices show symptoms and whether anyone obtained remote access. Ask the technician to explain whether their assessment covers one computer, shared storage, business accounts or the wider network. Request a clear statement of what they will investigate and what falls outside their service.

CISA explains that ransomware can encrypt files and involve stolen data or threats to publish it. It also warns that a ransomware event may follow an earlier network compromise. If you encounter a ransom demand or encrypted files, ask for incident-response capability, evidence preservation and a recovery plan. [3]

Tell the responder which operations you need to resume first, such as taking payments, accessing orders or running payroll. CISA recommends prioritizing restoration around critical services and the systems they depend on. Agree on those priorities before authorizing a rebuild. [3]

Verify the technician before granting access

Kentucky's Attorney General describes scammers who claim to provide Microsoft or Windows support, request remote access and demand money after locking a computer. The office also warns about pop-up support numbers and requests to open banking websites during a remote session. [2]

Obtain support contact details from the company's legitimate website, as the Attorney General recommends. Ask your chosen technician who will connect, which access tool they will use and how they will end access after the appointment. Keep banking activity outside the repair session. [2]

If you granted access to a suspicious caller, tell the responder what you installed, what information you disclosed and whether you opened financial accounts. Use a separate trusted device or phone to contact your bank and arrange support. Include unauthorized remote-access software and business account access in the assessment request.

Protect files and evidence before cleanup

For suspected ransomware, disconnect affected computers from Ethernet and Wi-Fi. CISA recommends powering down only if you cannot disconnect affected devices from the network through other means. Shutdown loses potential evidence held in memory. Coordinate the response with your IT contact by phone. [3]

Ask the responder how they will preserve logs and relevant evidence before removing software or rebuilding systems. CISA recommends preserving volatile evidence, maintaining offline encrypted backups and testing backup integrity. During recovery, it advises precautions against reinfecting clean systems. [3]

List essential folders, applications and existing backups. Agree on who can authorize copying, where the technician will store copies and when they will delete them. Require approval before a reset, drive replacement or reinstall. Arrange a check of important files and applications before accepting the work.

Compare estimates and define completion

Ask providers to quote the same incident-specific scope. Separate assessment, cleanup, file preservation, software reinstall, travel and follow-up support. Specify whether the estimate covers one device or the business environment. Set a spending limit and require approval for additional work.

Request a written estimate after describing the symptoms and your recovery priorities. Agree on a target for the first assessment and the next progress update. Discuss a temporary way to continue essential work while affected devices remain isolated. Ask the provider to identify uncertainties that could change the cost or schedule.

Before accepting the repair, request a record of what the technician found, changed and could not verify. Check agreed files and applications together. Ask for account-security, remote-access and backup instructions. CISA recommends addressing affected accounts and security gaps during recovery. [3]

CISA log-retention guidance to discuss with your business IT provider

Choose your next step before booking

Your hiring checklist

1. Record symptoms, affected devices and any remote access you granted.
2. Identify the business operations you need to restore first.
3. Verify the provider's contact details before granting access.
4. List essential files, applications and existing backups.
5. Agree on file access, copying, storage and deletion.
6. Approve a written scope, spending limit and progress-update schedule.
7. Require permission before a reset, reinstall or additional charges.
8. Keep the completion record, agreement, invoice and correspondence.

Frequently Asked Questions

Can I arrange remote virus removal?

Ask whether remote assessment fits your symptoms and agree on access limits before connecting. Verify the provider through its legitimate website. Kentucky's Attorney General warns that tech-support scammers request remote access and may ask customers to open banking websites. [2]

Should I turn off a computer with suspected ransomware?

Disconnect it from the network first. CISA recommends powering down only when other network-isolation methods are unavailable, because shutdown loses potential evidence in memory. Coordinate further action with your IT contact or responder. [3]

Does removing malware recover encrypted files?

Define cleanup and file recovery as separate parts of the scope. CISA describes ransomware encryption as making files unusable and recommends restoring from protected backups with precautions against reinfection. Ask the responder to explain available recovery options before authorizing a rebuild. [3]

Can Kentucky's Attorney General resolve my business repair dispute?

Business-purchase eligibility for the office's consumer mediation process is unverified. Ask the office before relying on that route. Its guidance advises contacting the business first, and it cannot act as your private attorney. If a business refuses mediation or cooperation, the office says it generally can only track the information. [1]