Do you know what Proposalcrypt Ransomware is?
Our malware analysts have tested Proposalcrypt Ransomware and concluded that it is a highly malicious program and you ought to remove as soon as possible. It was designed to infect your computer secretly and encrypt most of your files and then offer you to pay a ransom to decrypt them. Without a doubt, this program was created for extorting your money, but you should refrain from paying the ransom if your PC got infected with it because you cannot be certain that the cyber criminals will decrypt your files. Also, we have received unconfirmed information that a free decryption tool may soon be released. Please continue reading to find out more.
Proposalcrypt Ransomware is by no means a unique ransomware. It was configured to encrypt your files with the Advanced Encryption Standard (AES) algorithm which is also used by hundreds upon hundreds of similar programs that include the likes of Guardware@india.com Ransomware, VindowsLocker Ransomware, and OzozaLocker Ransomware. The AES algorithm is a strong encryption algorithm, so decrypting it is not easy. Still, each ransomware is different, and the key length may vary as well as the security of the application itself. Security researchers look for vulnerabilities with the code of the ransomware to break the encryption. From what we hear this may soon be the case with OzozaLocker Ransomware.
Our malware analysts say that Proposalcrypt Ransomware can encrypt many file formats that include but are not limited to .docx, .docm, .wps, .xls, .xlsx, .zip, .vtf, .001, .esm, .blob, .dmp, .wmv, .avi, .wma, .m4a, .wmv, .avi, .wma, .m4a, and many others. While encrypting these and other file formats, this ransomware appends them with the “.crypted” file extension. However, replacing .crypted with the original file extension will not decrypt your files.
Proposalcrypt Ransomware screenshot
Scroll down for full removal instructions
Once the encryption is complete, this ransomware will open its graphical user interface (GUI) that will ask you to send 1 BTC (an approximate 944.13 USD) to the provided Bitcoin wallet to decrypt your files. We want to point out that even if you send the 1 BTC asked there is no guarantee that this ransomware will initiate the decryption process, so we recommend that you refrain from paying the ransom.
In regards to Proposalcrypt Ransomware’s distribution channels, researchers have discovered that it is distributed through malicious email attachments. Its main executable is included as a file attachment and is named “proposal.doc__________________________.exe." Now, the actual length of the file is longer, but, as you can see, it features many underscores that form a line that moves the .exe (executable) file extension. Since a typical email box cannot show the full name of a long-named file, you do not see that it is an executable, but you might think that it is a document because of the deceptive “.doc” line in the name. This is how the cybercriminals aim to trick you into downloading or opening this file. It does not copy itself, so you have to delete it from the location you launched it from only.
We hope that you found this article informative. As you can see, Proposalcrypt Ransomware is one malicious program that can render your files inaccessible. However, paying the ransom to get them back is a risky option because you it might not decrypt your files after you pay. Therefore, we recommend that you delete this application as soon as you can. You can use an anti-malware program such as SpyHunter or our manual removal guide featured below.
Removal Guide
- Press Win+E keys.
- Enter each of the following addresses in the address box and hit Enter.
- %TEMP%
- %USERPROFILE%\Downloads
- %USERPROFILE%\Desktop
- Find proposal.doc_______.exe
- Right-click it and click Delete.
- Empty the Recycle Bin
In non-techie terms:
Our malware researchers have tested Proposalcrypt Ransomware and confirmed that it is a highly dangerous program that can encrypt your files with a strong encryption algorithm. We do not recommend that you pay the ransom because it might not decrypt your files and because you might be able to decrypt your files for free once a free decryption tool is out. So, in the meantime, we suggest that you remove this ransomware.