How To Fix A Mac That’s Affected By Ransomware: Step-By-Step Guide

Ransomware attacks are no longer limited to Windows PCs — Macs are increasingly becoming targets too. If your Mac is locked, files are encrypted, or you’re being asked to pay a ransom, don’t panic. You’re in the right place!

At MacRepair, we specialize in quickly diagnosing and resolving ransomware infections; you can get back to work faster, safer, and without losing precious data.

Follow this detailed guide to understand how you can fix a Mac affected by ransomware

Step 1: Identify the Ransomware Infection

Not all malware is ransomware. Here’s how to check:

• Symptoms of Ransomware:
  
  • Files renamed with strange extensions (e.g., .encrypted, .locked)
    
  • Pop-up messages demanding payment in Bitcoin or gift cards
    
  • Locked screen preventing you from accessing macOS
    
  • Unusual system behavior or missing files
    

If you see any of these symptoms, it’s time to take action — and fast.
Pro Tip: Early detection means a higher chance of full recovery!

Step 2: Disconnect Your Mac From the Internet

Immediately disable all internet connections to prevent the ransomware from communicating with its command-and-control servers or spreading to other devices.

• How to Disconnect Quickly:
  
  • Turn off Wi-Fi: Click the Wi-Fi icon in the menu bar > Turn Wi-Fi Off
    
  • Unplug Ethernet cables
    
  • Turn off Bluetooth if not needed
    

Important: Do NOT reboot or shutdown your Mac until advised by an expert. Some ransomware triggers further encryption on restart.

Step 3: Enter Safe Mode

Booting into Safe Mode can sometimes prevent the ransomware from loading.

Steps to Enter Safe Mode:

1. Shut down your Mac.
   
2. Turn it on and immediately press and hold the Shift key.
   
3. Release the Shift key when the login window appears.
   

This limits your Mac to essential operations and may allow you to safely inspect and remove malicious files.

Step 4: Scan Your Mac with Anti-Malware Software

Professional-grade malware removal tools can detect and eliminate ransomware.

Recommended Actions:

• Use reputable Mac antivirus tools like Malwarebytes for Mac or Bitdefender.
  
• Perform a full system scan, not just a quick scan.
  
• Follow the software’s instructions to quarantine and remove detected threats.
  

Step 5: Locate and Isolate Infected Files

Once ransomware is identified:

• Find all suspicious files
  
• Move them to an external drive (if possible)
  
• Do not open any encrypted files or run unknown applications
  

This step minimizes the spread of infection and helps data recovery specialists retrieve unaffected data.

Step 6: Check for Decryption Tools (Optional)

Some older ransomware strains have free decryption tools available.

• Websites like No More Ransom offer free tools to unlock files encrypted by known ransomware families.
  
• Identify the ransomware name (e.g., “KeRanger”, “EvilQuest”) and search for solutions.
  

Step 7: Restore Your Mac From a Backup

If you’ve been diligent about backups (like Time Machine backups), you can revert your Mac to a pre-infection state.

How to Restore From Time Machine:

1. Restart your Mac and enter macOS Recovery Mode (press Command + R during boot).
   
2. Select Restore from Time Machine Backup.
   
3. Choose a backup date before the infection.
   

Step 8: Erase and Reinstall macOS (Last Resort)

If ransomware can’t be removed and no backups exist, a clean reinstall is the safest option.

Steps to Reinstall macOS:

• Backup important uninfected files (if possible)
  
• Boot into Recovery Mode (Command + R)
  
• Select Disk Utility > Erase Macintosh HD
  
• Reinstall macOS from scratch
  

Step 9: Secure Your Mac After Cleanup

To avoid future infections:

• Update macOS and all apps regularly.
  
• Enable Firewall and set strong privacy settings.
  
• Use reputable antivirus and anti-malware tools.
  
• Create regular backups (use Time Machine or cloud backups).
  
• Be cautious with downloads and email attachments.
  

Why Choose MacRepair For Ransomware Removal?

30-Minute Service Guarantee
Certified Mac Technicians
Secure Data Recovery Solutions
Affordable Pricing
Free Diagnosis & Consultation
Friendly Walk-In Service – No Appointments Needed!

Whether you’re dealing with ransomware, viruses, slowdowns, or suspicious pop-ups, MacRepair is your go-to solution. Trust our team to get your Mac back to 100% — fast and stress-free!

Call Now: 0800 585 222 Visit Us: MacRepair Store

Final Thoughts

Dealing with ransomware can be a terrifying experience, but remember — the sooner you act, the better your chances of recovery. Following these steps can limit damage, but professional help offers the safest and fastest path to full restoration.