If a system is infected or an account is compromised, the following general recommendations can be followed.

In all cases, however, it is important not to panic and never to delete any data, as this would destroy any evidence.

Infected Systems

• If a system is currently being encrypted, it should be shut down or disconnected from power as quickly as possible to prevent data loss.
• If a system is sending spam, the network connection should be disconnected—for example, by unplugging the Ethernet cable.

Compromised Accounts

• For compromised accounts, such as email accounts, it is recommended to run a virus scan on the devices where the account was used.
• The password for a compromised account should be changed immediately from a clean device.

Further recommendations for action depend on the type of infection or the nature of the compromise.