If you've just opened an attachment and something feels off — a security warning, a Word document that flashed and closed, a sudden slowdown — act now rather than waiting to see what happens.

Immediate Steps

1. Disconnect from the network. Turn off Wi-Fi or unplug the ethernet cable. This stops malware from communicating out or spreading to other devices on the network while you assess the damage.
2. Don't shut down the computer yet. Some malware needs to be identified and removed while running; powering off can also destroy evidence IT may need if this is a business device. Disconnecting from the network is usually the safer first move.
3. Tell your IT team or MSP immediately. Don't wait to see if something bad happens first — the earlier they're looped in, the more they can contain.
4. Run a full antivirus/endpoint scan once IT gives the go-ahead, using your organization's managed security tool rather than a random downloaded scanner.
5. Change your passwords from a different, known-clean device — starting with email, then anything financial, then anything else that used the same password.
6. Watch for follow-on signs: unexpected pop-ups, programs you didn't install, emails sent from your account that you didn't write, or contacts reporting strange messages from you.

Common Questions

What if I'm on a personal device with no IT department?

Disconnect from the network, run a full scan with a reputable antivirus product, update all your passwords from a separate clean device, and turn on multi-factor authentication anywhere it isn't already on.

How do I know if the attachment actually did anything?

You often can't tell just by looking — a scan is the only reliable way to confirm. That's exactly why disconnecting from the network and scanning promptly matters more than trying to diagnose it yourself first.

Should I tell people if my account sent them something bad?

Yes. A quick heads-up lets your contacts avoid clicking whatever went out under your name, and it's far better for trust than staying quiet.