Do you know what Maktub Ransomware is?
Maktub Ransomware is the name of newly emerged Trojan infection that you do not want to find on your computer. There is no question about the malicious nature of this program. Once it sneaks onto your operating system, all your pictures, videos, documents, and program files are doomed. There is a good chance that you will never be able to use or access them again unless you pay the ransom. Of course, this is all about money. The criminals who created this malicious program want to extort money from you in return for your precious files. That is why they target your personal files mainly. However, what is the guarantee that you will actually get the private key that is needed for you to be able to unlock your files? Experience shows that such crooks rarely keep their word. Nevertheless, we cannot tell you not to pay; it is totally up to you. What we can tell you is that you should not hesitate for a second to remove Maktub Ransomware because even if you cannot get your files back, you need to eliminate this threat source so that you can use your computer.
According to our researchers, this Trojan ransomware can infect your computer through spam e-mails. The executable file of this threat is disguised as a zipped text document attachment. It is also possible that the unzipped .exe file has a Notepad icon to hide its real purpose and function. When you download this archive and extract it, nothing really happens. However, when you want to open this alleged text document, the ransomware activates and starts its dirty business. This infection does not copy its file into other folders and does not create any more executable files. It simply operates through this one file. So if you do not want to let this Trojan on board, all you need to do is not open e-mails that are not specifically sent for you, i.e., you do not expect to receive them. It is possible that more sophisticated spams imitate a sender; therefore, you may believe that you are actually opening a mail from a government office or a well-known institution. It might also happen that one of the people from your contact list will be used to pose as the sender. That is why you need to be extra careful.
Maktub Ransomware screenshot
Scroll down for full removal instructions
In these cases even spam filters cannot help you. Whatever slips through the filtering algorithms is up to you to filter out. Hopefully, now you see why it is not a good idea just to click through all your incoming mails. Even more so, because it is possible that a malicious spam mail might drop infections onto your system the moment you open it. All in all, you need to think twice before clicking on any mail or attachments. When in doubt, try to make sure that it was really intended for you and it was sent by trustworthy parties. Once this Trojan finds a way to your computer, you will be left with no choice; you will have to delete Maktub Ransomware immediately.
This ransomware can make extensive damage in less than two minutes. So even if you were lucky or quick enough to realize that you let this beast onto your computer, it would be too late to stop it. As a matter of fact, this is a rather tricky infection. It does not only disguise itself by having a Notepad icon, but once you run the executable file, after about 20 to 60 seconds, it opens a rich text document that looks like a legitimate privacy policy. You may even think that it is the file itself that you have opened, and you start reading it. But you most probably just get more confused as you go on line by line. According to our researchers, this text may only be used to draw your attention so that in the background Maktub Ransomware can finish the encryption of your files. In fact, there is a date highlighted in this text, which is April 1st. Do you think that these crooks have some sense of humor and they want to perform an April Fools’ prank? They definitely manage to fool users because while reading this document, all their personal files get taken hostage.
When the encryption has finished, all your desktop shortcuts, icons are moved to a newly created folder and a warning window comes up. All this, after about two minutes tops. The executable file does not stop running since the encryption and the ransom note is also operated by the same file. This ransomware does not lock your screen, although you cannot simply close this warning pop-up. This window informs you about the fact that your files have been encrypted and they are impossible to decrypt without the private key, which is safely stored on a secret server. You can only get this key if you follow the instructions. You must visit a website (bs7aygotd2rnjl4o.onion.link) but if you experience problems, you should download the Tor browser and visit the given page for further instructions. Obviously, you have to transfer the ransom fee to these criminals and then you are supposed to get your private key so that you can decrypt your files by entering this key on the provided website. You need to be quite fast to decide because you are only given 12 hours to make the payment. If you do not comply with the terms, you will lose the key and that means you will lose all your files as well.
This could be a real nightmare for any computer user. However, if you are a security-minded person, you most probably regularly make copies of your files on an external drive. In this case, you are saved. But you still need to remove Maktub Ransomware ASAP as well as all other possible threats and the encrypted files, too. Only then it is safe for you to copy the backup back to your PC. Unfortunately, we cannot provide you a tool that could decrypt your files. Nevertheless, we can tell you how you can eliminate Maktub Ransomware. It is not even that difficult. After killing the process it runs, you just need to remove the files it created. Please follow our instructions below to make sure that this threat is fully gone. If you need assistance with the removal, please leave us a comment below. If you want to provide effective protection for your PC, we recommend that you use a trustworthy anti-malware program.
Maktub Ransomware removal from Windows
- Tap Win+R and type in taskmgr to open the Task Manager.
- Locate the process this infection is running. Its name will be the same as the executable you extracted.
- Click End task.
- Close the Task Manager.
- Tap Win+E to open the File Explorer.
- Find and delete the malicious file. (Wherever you downloaded and extracted it.)
- Delete the .html files ("_DECRYPT_INFO_[eqijxri].html") from your desktop that were created by this Trojan. The “eqijxri” part can be random and different for all users.
- Empty the Recycle Bin.
- Reboot your system.
In non-techie terms:
Maktub Ransomware is a dangerous Trojan ransomware infection that can encrypt your personal files (images, videos, documents, etc.) in just two minutes. This malware can enter you computer without your knowledge; however, you could actually prevent this from happening if you do not open spam e-mails and click on their attachments. This is the way how this beast is spreading over the web. Once the encryption is done, you are informed about how you can obtain your private key by paying the demanded ransom fee. It is impossible to recover your files without this private key, but there is no guarantee that these criminals will really decrypt your files after you pay them. However you choose to act, you should know that you should remove Maktub Ransomware right away because it may infect any new files. If you want to protect your PC from similar horrors, you should consider installing a reputable malware removal tool.