Get the junk off your computer, properly.
Popups claiming your machine is infected. A browser that opens to a search page you never chose. Files you can't open anymore. We clean it up, then make sure your accounts aren't still exposed.
The usual signs
- Full-screen popups with a phone number, telling you to call Microsoft or Apple support. Nobody legitimate does this
- Your browser opens to a different search engine, and changing it back doesn't stick
- New toolbars, extensions, or programs you didn't install
- Ads appearing on sites that never had ads
- The machine got slow and loud around the same time everything else started
- Your files have been renamed and there's a note demanding payment
If you called a number on a popup and let someone connect to your machine, tell us that first. It changes what we check and how urgent the account work is.
Removal, then verification
Running a scanner and watching it say "clean" is not the same as the machine being clean. Scanners miss things, and the things they miss are the ones written to be missed.
We check what runs at startup, what's scheduled to run later, browser extensions and policies, proxy and DNS settings, and any remote access tooling that got installed while someone had control of the machine. Then we remove it, restart, and check again from a cold boot, because plenty of malware only reappears on the second start.
We also tell you what got in and how, since that's usually the part that stops it happening again.
Ransomware, and when a clean reinstall is the honest answer
We can't decrypt ransomware. Almost nobody can, and any shop that tells you otherwise is either paying the ransom on your behalf or guessing. What we can do is work out what got hit, check whether a working backup exists, and get you back onto a clean machine.
Ransomware or not, once something has had administrator access to a computer, there's a point where cleaning stops being provable. If we can't say with a straight face that the machine is trustworthy, we'll recommend wiping it and reinstalling, with your files carried across and checked on the way. That's slower and it's the right answer. We'd rather tell you that than hand back a machine we're unsure about.
If your files are the problem rather than the machine, start with data backup and recovery.
Locking down your accounts afterward
Cleaning the computer doesn't help if your email password was captured last week. Whoever had access to the machine may still have access to your accounts, and email is the one that unlocks the rest.
- Change the email password first, from a device we know is clean
- Turn on two-factor authentication on email, banking, and anything holding a card number
- Sign out every other session and remove devices you don't recognize
- Check for forwarding rules and recovery addresses someone added without you noticing. It's a common trick and easy to miss
- Check saved passwords in the browser, and assume someone else now has anything stored there
If money moved or card details were entered, call your bank before you call us. That part is time-sensitive.
What it costs
- Flat $85 diagnostic. We find out what's on the machine, then quote the cleanup in writing. No work happens without your approval
- Approved work is $85 per hour, remote or on-site
- Rush and after-hours work adds a flat $85
- If a wipe and reinstall is the right call, we quote it with your file transfer included
We can do most of this remotely, so you don't have to unplug anything or carry a tower anywhere. If the machine has a hardware fault underneath the mess, see computer repair. See full pricing.
Think you've been hit?
Stop using the machine for banking and email, then get in touch. We reply to new inquiries within one business day.