01Understand what happened first
Tell us what the employee observed, what was clicked or installed and whether other computers show the same behavior. Preserve useful details and alert your administrator. If files are encrypted, sensitive information may be exposed or several systems are affected, specialist incident response may be needed before routine cleanup.
02Agree on cleanup and recovery work
We assess the device and explain supported cleanup, repair or reinstallation options. Important files, application licenses and account access affect that plan. Your administrator should manage account-security actions; after approved workstation work, we review the observed issue and practical steps for reducing repeat problems.