A counter computer is a uniquely bad security position. It is open to the public all day, it is expected to open files from strangers, it often runs without antivirus properly configured, and it holds every customer document that has passed through. Most shop owners treat this as an inconvenience until the day the machine will not boot, the printer stops being recognised, and a week of revenue goes with it. This guide is about making the problem small and routine rather than dramatic and expensive.

How counter computers actually get infected

The pen drive is the obvious culprit and it is no longer the main one. Understand the real order of risk before deciding what to spend money on.

The most damaging infections on a counter PC are not dramatic. They are the quiet ones that disable the print spooler or change an extension association, so documents open in the wrong program and jobs simply never appear.

What a lockdown actually involves

This is a twenty-minute weekly routine plus a one-time setup. It is not exotic, and every step is free.

• Step 1 — Turn on automatic updates for the operating system and let it finish. An unpatched machine is the single largest risk and the easiest to close.
• Step 2 — Turn on the built-in antivirus and leave it alone. It is adequate for this purpose if it is actually enabled and not permanently suppressed.
• Step 3 — Turn off automatic opening of downloaded files. A file that downloads should wait for you, not open itself.
• Step 4 — Enable the firewall and keep it on. Do not add exceptions "to make printing work" — a printer exception is not normally required on the same machine.
• Step 5 — Set a strong login password on the Windows account. The counter PC is physically accessible to anyone.
• Step 6 — Create one standard user account and use it for daily work. Do not browse the web on an administrator account.
• Step 7 — Turn on file history or a scheduled backup to a drive that is not the system disk.

Most infections at a counter succeed because the operating system is unpatched and the daily account has administrator rights. Fixing those two things removes the majority of the risk at no cost, and it is worth doing before buying anything.

The daily five-minute routine

• Before opening: check the antivirus has actually run its scheduled scan and has not been paused.
• Before printing: preview the file. You need to see it anyway, and a file that will not preview is a file you should not open on the counter machine.
• Never open a file type you do not print from inside the Windows Explorer window by double-clicking. Open the application you expect, then open the file from inside it.
• Do not plug in an unknown USB drive. If a customer insists, copy the file across using a medium you control rather than opening the drive directly.
• At close: clear the Downloads folder and the desktop. This is habit, not security, but it is how you notice a file you did not expect.

Previewing every file is not a security measure, it is a quality measure. Most of what goes wrong at a counter is a wrong file or a wrong version, and both are visible in a preview for free.

Reducing the surface instead of defending it

The most effective change is to stop opening stranger files on the machine that runs your shop. This is the argument for moving intake off the counter PC entirely.

• If customers upload through a QR code on a phone, the file travels from their device to storage and arrives in your queue as a controlled entry with a specification attached — not as an arbitrary file someone handed you.
• The counter PC then displays a preview rather than opening the file in an application a customer influenced.
• Files that never arrive as local downloads cannot sit in a Downloads folder waiting for someone to double-click them.
• And if the intake channel is browser-based, there is no USB port in the workflow at all, which removes the most common vector by design rather than by policy.

This is not a substitute for a locked-down machine. It is a way of making the machine's job much simpler, so that the lockdown only has to handle ordinary risk rather than constant hostile input.

Symptoms worth acting on immediately

What to do when you think it is already infected

• Disconnect the machine from the network first. This stops anything spreading to the printer, the phone, or the customer devices on the same Wi-Fi.
• Do not keep working on it. A counter machine that is compromised and still in use is worse than one that is down, because you have no idea what was exposed.
• Scan from a clean device using a second opinion scanner, or reinstall. For a counter machine, reinstalling is often faster and cheaper than a prolonged cleanup.
• Change any password that was typed on that machine.
• Check the printer is still on the network and has not been reconfigured, and print a test page before resuming.

One more thing about customer documents

Security and privacy are related but not the same, and it is worth separating them. A machine can be perfectly clean and still be a privacy problem, because the open Downloads folder contains last week's marksheets, bank statements and identity documents. Automatic deletion on a fixed schedule is the only version of this that is genuinely safe, because it does not depend on somebody remembering. Our guide to customer document privacy covers the legal and practical detail on retention.

A clean computer is a technical achievement. A counter that does not accumulate other people's bank statements is a professional one. They need both, and the second is easier.

Where to go next

For the intake side that reduces this risk most, our guide to ending the WhatsApp queue explains why the old arrangement forces files onto your counter PC. For the workflow once files arrive safely, our contactless counter setup guide covers the transition. And for the retention question specifically, our customer document privacy guide covers what you should be able to tell a customer about their file after the print.