Skip to content

Malware, remote access, ransomware. What to do next

Use this page if you clicked something, installed something, or let someone control your device.
This helps you regain control safely.

Use this topic if you or someone you support:
  • Clicked a link and then saw strange pop ups, warnings, or new screens
  • Opened an attachment and now the device is acting oddly
  • Installed an app you now regret, or allowed remote access
  • Was told the device is “infected”, “locked”, or “needs support”

If money is involved or you shared banking details, go to:
Money at risk. What to do right now

If you feel in immediate danger

Call 999 or 112.

A helpful rule

Do not keep following instructions from the caller or message sender.
Stop contact first. Then work through the steps below.

Do these 4 things first

1. Disconnect

  • Turn off Wi Fi, or switch on airplane mode.
  • If you can, unplug the internet cable.
  • This can stop further access while you act.

2. Stop remote access

If someone is still connected.

  • End the call.
  • Close the browser tab if you can.
  • Restart the device if you need to break the connection.

3. Run a security scan

  • Run an antivirus or security scan on the device.
  • Remove anything the scan flags.
  • Update your device and browser when you are able.

4. Change passwords from a clean route

If you think passwords were exposed.

  • Use a different trusted device if possible.
  • Start with your email password, then banking, then other key accounts.
  • Turn on two factor authentication where you can.

Important

If the account is your email account, treat this as urgent. Email can be used to take over other accounts.

If you see a ransom message
  • Do not pay.
  • Disconnect from the internet.
  • Get help from a trusted tech support person or a reputable repair shop.

If you feel threatened or pressured, report to your local Garda station.

If banking was open during remote access

Treat it as urgent.

Save evidence (optional). 60 seconds

If you can, capture a little evidence. It helps later.

  • Screenshot the pop up or warning screen.
  • Note the date and time.
  • Keep any bank alerts or transaction screenshots.

You can also use:
Report and record. Simple incident log

Important

  • If you want to share evidence with someone you trust, share a screenshot. Do not forward a live link.
  • Do not share screenshots that include one-time codes, PINs, or passwords.

Tip

If you want a simple place to write everything down, use: Report and record. Simple incident log

If you want to talk to someone