How to remove ProposalCrypt ransomware virus

Yet another HiddenCrypt variant: ProposalCrypt ransomware

ProposalCrypt virus is a perfect example of malware developed by a script kiddie^[1]. If a bad person wants its own ransomware but hardly has any programming skills, all he needs to do is to steal someone else’s code and adapt it to a new ransomware project. ProposalCrypt ransomware is built using parts of HiddenCrypt code^[2], which means that you can revert damage that it does without having to pay a ransom. The ransomware encrypts victim’s data stored on the vulnerable computer with AES encryption^[3] and adds .crypted file extensions to them. Compromised files become useless – it is no longer possible to use them or view them. However, the virus leaves some information for the victim in a rich text box called !!!Warning Message!!!. The greedy criminal asks 1 Bitcoin in exchange for the decryption key. In case you are not familiar with this virtual currency, 1 Bitcoin equals to approximately 865 USD. The message from the victim includes frauds’ Bitcoin wallet address and some information about Bitcoin currency. According to criminals, payment should be confirmed within 2 hours.

You should not pay the ransom as files can be decrypted using HiddenTear decrypter. However, if you have been attacked by this ransomware virus, you should definitely pay more attention to your computer’s security and also backup your files if you haven’t done it yet. Ransomware viruses can be much more dangerous, for example, viruses like Locky or Cerber are undefeatable^[4], and there is no way to restore encrypted files, no matter how hard you try. However, since you do not even have to consider the option of paying the ransom, remove ProposalCrypt virus using tools that we recommend or the security software that you have on your computer. We suggest using FortectIntego or SpyHunterCombo Cleaner for ProposalCrypt removal.

How can I protect myself from ransomware attacks?

Ransomware is a powerful virus, but considering that viruses have been using same dissemination techniques over the years, it is quite surprising that computer users still fall for phony email messages that scammers send out to thousands of people. Speaking of ProposalCrypt malware, we can say that it spreads in the form of a fake .doc file that is actually an obfuscated .exe file. The name of the malicious executive file is proposal.doc___________________.exe. As you can see, the filename contains a lot of low lines after the fake .doc extension. This is done in order to deceive the victim and trick him into thinking that it is a document, not an executive file. Once opened, the virus encrypts all files without making any exceptions. To lower the risk of becoming a ransomware victim, you should never open emails or email attachments sent by unknown people, watch what you click on the Internet, and install programs using Custom or Advanced settings.

How to clean the computer from ProposalCrypt virus’ remains?

The best way to remove ProposalCrypt virus is to command an anti-malware program to do it, of course. However, if you insist on removing the virus manually, make sure that you know how to do it. Ransomware viruses severely mess up the computer system, often by adding or changing Registry Key values, installing new programs, such as Trojans or backdoors^[5], and these are extremely hard to remove. Therefore, we believe that automatic ProposalCrypt removal is the best option. Below, you can find a guide on how to delete the virus and restore encrypted data.