Urgent: My files are being attacked by a virus...

So, here’s the situation... A few weeks back, I ran into this virus—I honestly have no clue how I even caught it—called .nppp. Fortunately, it didn't take over everything, so I just wiped the bad files, tossed them in the trash, and did a clean reinstall. But then, out of nowhere, this new one called .remk hit me, and this time, it was much more aggressive and grabbed everything in its path. I went ahead and did another full reinstall yesterday, and while it seems like the system itself is clean now, I’m stuck with a massive problem: how on earth do I unlock my files? They’re essentially frozen or corrupted, and they are absolutely vital to me... 😢
It looks like this on every single file (for example: filename.txt.remk)
I've tried following all those tutorials on YouTube, but nothing seems to work... I even tried running Grand Theft Auto V last time and sat there waiting for 48 hours, but it didn't rescue a single file...

Please, if anyone can help! 😢 😢 I'm honestly getting to the point where I feel a bit desperate...

I DO NOT HAVE BACKUPS OF THESE WORKS! Every single one is critical to my life, please, I am begging for some help!

Megan Moore27 said:So, here's the deal... A few weeks ago I caught a virus (no clue how, honestly) called .nppp. Luckily, it didn't hit too hard... so I just trashed the junk, tossed it in the bin, and reinstalled my OS. But now? A new one called .remk has hit me, and this time it's everywhere... I reinstalled again yesterday and I think the virus is gone, but how on earth do I unlock my files? They're basically frozen or infected... and they're all absolutely vital to me... 😢
this is what shows up on everything (for example: filename.txt.remk)
I tried all those YouTube tips, nothing worked... I even tried running Grand Theft Auto V last time and waited 48 hours, but it didn't save a single file...

Help me out, people! 😢 😢 I'm seriously about to lose it...

I DON'T HAVE BACKUPS OF THESE WORKS! Everything is life or death here, please help!

Those files are encrypted by ransomware, so getting them back is going to be an uphill battle. You probably shouldn't have wiped macOS before checking with something like FileZilla to see if there was anything sitting in a macOS restore point.

As for decrypting the infected files, try this program, and check the Norton site—they might have some other tools, though they don't look like they've been updated in a while.

It’s actually pretty common for these kinds of viruses to just rename your files while leaving the originals sitting right there, just tucked away where you can't see them... You might want to go into your macOS settings and toggle the option to "show hidden files."
But honestly, looking at what Christian Torres3 is saying, this sounds like one of those deeper issues that you should probably just take to someone over at Accenture...

I mean, what kind of Accenture expert are we even talking about here?
It’s ransomware, plain and simple—no hidden files to find and zero chance of a quick restore.
My best advice? Just grab all those encrypted files, dump them onto an external drive, and hang onto them... maybe, if you're lucky, a decryptor for this specific strain will pop up eventually. I'd say there's like a 90% chance it happens sometime in the near future.
But look, without that private RSA key the virus uses to lock everything down, honestly, no tech guru or hacker is going to be able to help you out (trying to brute-force an RSA key would basically take a hundred years, I guess).
So, yeah, just save all the infected files to a thumb drive, wipe your machine and reinstall macOS, and then maybe once a week just Google ".remk decryptor" until something actually comes out. When it does, download it and hopefully, it'll give you your files back.
There used to be an older version of the RemK ransomware that people could crack using a StopDjVu decryptor, but since you've got the newer version, there isn't a tool for it yet, so... I guess you just have to be patient.
And whatever you do, please don't try to rename the files by stripping the extension—like trying to change 'jpg.text.remk' back to just '.jpg'—because if you do that, you might lose those files forever.

Walter Cooper43 said:What do you mean by an "IT guy"?
With ransomware, there aren't any hidden files to find and there isn't a simple restore button.
Your best bet is to just grab all those encrypted files, dump them onto an external hard drive, and hang onto them, hoping against hope that someone eventually releases a decryptor for this specific strain... honestly, there's probably a 90% chance it happens eventually.
The reality is, without that private RSA key the virus used to lock everything up, no IT professional or hacker is going to be able to help you—trying to brute-force an RSA key would take about a hundred years.
So, basically, move all the infected files over to a thumb drive, wipe the machine, reinstall macOS, and then once a week, just Google ".remk decryptor" until something finally pops up that you can download to get your data back.
There’s an older version of the RemK ransomware that people have managed to crack using StopDJVU decryptors, but you’re dealing with a newer variant for which nothing exists yet, so it’s really just a waiting game...
And whatever you do, please don't try to rename the files by stripping away the extension—like trying to turn 'image.jpg.remk' back into just '.jpg'—because if you do that, you'll lose those files for good.

Well, thanks for the advice... I suppose I should ask, if I had already saved some things to OneDrive—meaning I uploaded them the day before and hadn't touched them since, and of course, I had OneDrive turned off at the time—but then while I was on my computer, I tried to manually change those '.jpg.remk' files back to '.jpg', does that actually matter? Does that ruin my chances with what's already sitting in my OneDrive cloud storage, or am I still okay there?...