TL;DR
Your files have been encrypted by Makop ransomware and renamed with a .makop extension. This guide provides steps to identify the infection, isolate your system, report the incident, attempt decryption (if possible), and restore from backups. Do not pay the ransom unless you have absolutely no other option – there’s no guarantee of file recovery.
1. Identify the Infection
Makop ransomware typically spreads through phishing emails, malicious downloads, or exploiting vulnerabilities in software. Look for these signs:
- Files with the .makop extension.
- Ransom notes (usually text files or HTML documents) containing payment instructions and a unique ID. These often appear on your desktop or in folders where encrypted files were located.
- High CPU usage, even when idle.
- Unexpected pop-up windows or error messages.
2. Isolate the Infected System
Immediately disconnect the infected computer from the internet and any network shares to prevent further spread of the ransomware.
- Unplug the Ethernet cable.
- Disable Wi-Fi: Open your Network settings (Windows) or System Preferences > Network (macOS) and turn off your wireless connection.
- Disconnect any external drives or storage devices.
3. Report the Incident
Reporting helps cyber security authorities track ransomware attacks and potentially develop decryption tools.
- Action Fraud (UK): https://www.actionfraud.police.uk
- National Cyber Security Centre (NCSC): https://www.ncsc.gov.uk
4. Attempt Decryption
Whether decryption is possible depends on the specific Makop variant and whether a decryption tool exists. Here’s how to check:
- No More Ransom Project: https://www.nomoreransom.org This website provides tools and information for decrypting files from various ransomware families. Upload a sample encrypted file (and the ransom note) to see if they can identify it and offer a solution.
- ID Ransomware: https://id-ransomware.malwarehunterteam.com This service attempts to identify the ransomware based on file characteristics or ransom note content.
If a decryption tool is available, follow the instructions provided carefully.
5. Restore from Backups
This is the most reliable method of recovery if you have recent backups.
- Verify Backup Integrity: Before restoring, ensure your backups are clean and haven’t been infected with ransomware.
- Restore Process: Copy the backed-up files to a different location (not the original infected drive) before restoring them. This prevents re-infection.
If you use Windows Backup:
wbadmin get versions -backupTarget:E:(Replace ‘E:’ with your backup drive letter)
6. Remove the Ransomware
Even if you restore from backups, it’s crucial to remove the ransomware from your system.
- Boot into Safe Mode: Restart your computer in Safe Mode (Windows) or Recovery Mode (macOS). This limits the ransomware’s ability to run.
- Run a Malware Scan: Use a reputable anti-malware program (e.g., Windows Defender, Malwarebytes) to scan and remove the ransomware. Ensure it is up to date before scanning.
Example using Malwarebytes:
mbam -scan(This assumes you have Malwarebytes installed)
7. Prevent Future Infections
- Keep Software Updated: Regularly update your operating system, web browser, and all software applications.
- Use Strong Passwords: Create strong, unique passwords for all accounts.
- Enable Two-Factor Authentication (2FA): Where available, enable 2FA for added security.
- Be Careful with Emails: Avoid opening suspicious emails or clicking on links from unknown senders.
- Use a Firewall: Ensure your firewall is enabled and properly configured.
- Regular Backups: Continue to perform regular backups of your important data.