First steps
Record the domain, issue time, error messages, recent changes and symptoms. Do not immediately delete files that may explain the infection source.
Recovery
Safe restore may require backup, application updates, password changes, file scanning and e-mail/DNS verification.
After the incident
After restoring operation, identify the cause, update components, review user accounts and enable additional safeguards.