Proposalcrypt Ransomware

Posted by Lisa Blanc on January 11, 2017

What is Proposalcrypt Ransomware?

Proposalcrypt Ransomware is a computer infection that targets a number of files with the intention to make users pay a ransom fee. The program will deny access to most of the commonly-used files because it will have them encrypted, but that should not push you into spending your money on this infection.

In this description, you will find out more about the program and how it spreads around. What’s more, it should be possible to decrypt your files without paying the ransom because the infection does not seem to be fully developed yet. Either way, you should do everything you can to remove Proposalcrypt Ransomware from your computer. test

Where does Proposalcrypt Ransomware come from?

There might be several ways for the ransomware to enter your system, but we believe that Proposalcrypt Ransomware gets distributed via spam email attachments. This means that users download and install these malicious programs themselves. Of course, you did not know that the file you opened was the installer, but that just shows how important it is to remain vigilant and attentive when you open email attachments.

It is very likely that the installer for Proposalcrypt Ransomware will pretend to be an official document sent by some financial institution or an online store. According to our research, the installer file poses as a .doc file, so users are quick to open it. Please note that reputable institutions would hardly ever send important documents in email attachments. It is a lot more likely they would send the document embedded in the message itself, or there would be a secure outgoing link.

If you still think you have to open a particular attachment, but you are not sure whether it is safe or not, you can always scan it with a security tool. This way, you will find out whether the file you have downloaded is dangerous or not.

What does Proposalcrypt Ransomware do?

The program functions just like most of the other ransomware infections out there. The moment you launch the installer file, Proposalcrypt Ransomware scans your system searching for supported file formats. The list of extensions targeted by the infection is relatively long, so it is very likely that most of your files will be affected by this program. Once the files get encrypted by the ransomware application, they get the “.crypted” extension added, and it makes it really easy to tell which files are no longer accessible. Aside from blocking your files, the program also displays the following ransom note:

!!!Warning Message!!!

We are sorry to say that your computer and your files have been encrypted
but wait, don’t worry. There is a way that you can restore your computer and all of your files

To get your files fast, please transfer 1 Bitcoin
to our wallet address
<…>
Payment should be confirmed in about 2 hours after payment made.

Although the notification makes it seem as though it is possible to get your files back if you pay for the decryption tool, our research suggests that no payments have been made to the given bitcoin wallet. And of course, why would you make the payment if it is possible to decrypt the files without the key issued by these criminals?

How do I remove Proposalcrypt Ransomware?

Sometimes it is hard to deal with a ransomware program when it locks your screen or auto-starts with Windows each time you turn on your computer. Luckily, Proposalcrypt Ransomware does not do that. So if you restart your computer, the annoying ransom note should not pop up on your screen again. Unfortunately, your files will remain encrypted, and you will have to get rid of this program.

To delete the infection, you need to remove the proposal.doc file that was launched right before the infection took place. Sometimes the program may change its name, but the file location is the same. The program’s files usually get dropped in the Downloads folder, your Desktop or the %TEMP% directory. Simply look for double extension files like .doc.exe, and you will be able to remove the application.

If you think that manual removal is too much of a task for you, you can get rid of the infection with an automated antispyware tool. Perhaps that would be the most efficient way to protect your PC from harm.