Hey you,
BE IN THE KNOW!

35,000 ransomware infections per month and you still believe you are protected?

Sign up to receive:

  • alerts
  • news
  • free how-to-remove guides

of the newest online threats - directly to your inbox:


Remove ProposalCrypt Ransomware and Restore .crypted Files

This article will help you remove ProposalCrypt ransomware completely. Follow the ransomware removal instructions provided in the end of this article.

ProposalCrypt is a ransomware that appears to have a lockscreen. Your files will get encrypted with the .crypted extension being appended to all files after the process is finished. ProposalCrypt searches to encrypt files with more than 200 different extensions. The ransom note is made to look like a big warning message. Continue reading to see in what ways you can try to restore your files.

Threat Summary

NameProposalCrypt
TypeRansomware
Short DescriptionThe ransomware seeks to encrypt files with more than 200 different extensions.
SymptomsThe ransomware will encrypt your files and put the .crypted extension on them after the encryption process is complete. A ransom message will be displayed afterward.
Distribution MethodSpam Emails, Email Attachments
Detection Tool See If Your System Has Been Affected by ProposalCrypt

Download

Malware Removal Tool

User ExperienceJoin Our Forum to Discuss ProposalCrypt.
Data Recovery ToolWindows Data Recovery by Stellar Phoenix Notice! This product scans your drive sectors to recover lost files and it may not recover 100% of the encrypted files, but only few of them, depending on the situation and whether or not you have reformatted your drive.

ProposalCrypt Ransomware – Distribution Ways

ProposalCrypt ransomware might be distributed via different ways. A payload file exists that executes the malicious script of the ransomware which infects your computer machine. You can view the analysis of VirusTotal for such an executable file of this virus containing its payload, from the picture right here:

ProposalCrypt ransomware might be distributing the same payload file on social media networks and ones for file-sharing. A huge number of freeware applications could be promoted as useful on the Web but in actuality hide the malicious script of the virus. Do not be opening files from suspicious sources like emails or links, especially not after you just downloading them. First, you should perform a scan with a security tool and check their size and signatures for anything that seems out of the ordinary. You should read the tips to prevent ransomware from the topic in the forum section.

ProposalCrypt Ransomware – Technical Analysis

The ProposalCrypt is a ransomware cryptovirus. It seems to feature a screenlocker, as well. It will encrypt files on your computer system with one and the same extension.

ProposalCrypt ransomware could make entries in the Windows Registry to achieve persistence. Those registry entries are usually designed in a way that will start the virus automatically with each launch of the Windows Operating System. That can allow for the lockscreen to stay up, thus deeming your computer locked. The lockscreen might be bypassed easily.

The ransom note will appear inside a window. The message includes what the demands of the cybercriminals for the ransom price is, along with the other instructions and demands for decrypting your files. You can view the ransom message in the screenshot below:

The ransom note reads the following:

!!!Warning Message!!!
We are sorry to say that your computer and your files have been encrypted
but wait, don’t worry. There is a way that you can restore your computer and all of your files
To get your files fast, please transfer 1 Bitcoin
to our wallet address
1Q6bdWz5pKLFxNTqqcD9kULhMCdeuU1L2Y
and click “Check Wallet and Decrypt files” button.
Payment should be confirmed in about 2 hours after payment made.
Check Wallet and Decrypt files
How to buy Bitcoins?
Please check this website https://coinatmradar.com where you can find Bitcoin ATM all over the world.

The cyber crooks have explicitly written inside the ransom message, that the demanded sum of money to be paid for decryption is one Bitcoin. That amount equals to 860 US dollars. However, you should NOT in any circumstances pay these cybercriminals. Your data may not be restored and nobody can give you an actual guarantee of that. Plus, giving money to the criminals can result only in supporting them financially and boosting their faith in the making of ransomware as a business model. Besides, according to malware researchers, the ransomware seems to be decryptable.

Right down here below you can see a list with file extensions which the ProposalCrypt ransomware seeks to encrypt:

→.001, .3fr, .7z, .accdb, .ai, .apk, .arch00, .arw, .asset, .avi, .bar, .bay, .bc6, .bc7, .big, .bik, .bin, .bkf, .bkp, .blob, .bsa, .c, .cab, .cas, .cdr, .cer, .cfr, .class, .con, .cpp, .cpp, .cr2, .crt, .crw, .cs, .cs, .css, .csv, .d3dbsp, .das, .DayZProfile, .dbf, .db0, .dcr, .der, .desc, .dmp, .dng, .doc, .docm, .docx, .dwg, .dxq, .epk, .eps, .erf, .esm, .exe, .ff, .flv, .forge, .fos, .fpk, .fsh, .gdb, .gho, .gif, .h, .hkdb, .hkx, .hplg, .htm, .html, .hvpl, .ibank, .icxs, .im, .indd, .iso, .itdb, .itl, .itm, .iwd, .iwi, .jar, .java, .jpe, .jpeg, .jpg, .js, .kdc, .kf, .layout, .lbf, .litemod, .lnq, .lrf, .ltx, .lvl, .m2, .m3u, .m4a, .map, .mcgame, .mcmeta, .mdb, .mdbackup, .mddata, .mdf, .mef, .menu, .mlx, .mp3, .mp4, .mpq, .mpqge, .mrwref, .ncf, .nrw, .ntl, .odb, .odc, .odm, .odp, .ods, .odt, .orf, .p12, .p7b, .p7c, .pak, .pdd, .pdf, .pef, .pem, .pfx, .pkpass, .png, .png, .ppt, .pptm, .pptx, .psd, .psk, .pst, .ptx, .py, .qdf, .qic, .r3d, .raf, .rar, .raw, .re4, .rgss3a, .rim, .rofl, .rtf, .rw2, .rwl, .sav, .sb, .sb, .sc2save, .sid, .sidd, .sidn, .sie, .sin, .sis, .slm, .snx, .sql, .sr2, .srf, .srw, .sum, .svg, .syncdb, .t12, .t13, .tax, .tor, .torrent, .ttarch2, .txt, .unity3d, .upk, .vdf, .vfs0, .vpk, .vpp_pc, .vtf, .w3x, .wb2, .wma,.wmk, .wmo, .wmo, .wmv, .wotreplay, .wpd, .wps, .x3f, .xf, .xlk, .xls, .xlsb, .xlsm, .xlsx, .zip, .ztmp

Extension List Source: @MalwareHunterTeam

All files which have extensions from the above list are going to get encrypted with the extension .crypted. Continue to read and see if you can unlock some of your files, while you wait for an official decryptor tool for this particular ransomware to come out.

Remove ProposalCrypt Ransomware and Restore .crypted Files

If your computer got infected with the ProposalCrypt ransomware virus, you should have some experience in removing malware. You should get rid of this ransomware as fast as possible before it can have the chance to spread further and infect more computers. You should remove the ransomware and follow the step-by-step instructions guide given below.

Manually delete ProposalCrypt from your computer

Note! Substantial notification about the ProposalCrypt threat: Manual removal of ProposalCrypt requires interference with system files and registries. Thus, it can cause damage to your PC. Even if your computer skills are not at a professional level, don’t worry. You can do the removal yourself just in 5 minutes, using a malware removal tool.

1. Boot Your PC In Safe Mode to isolate and remove ProposalCrypt files and objects
2.Find malicious files created by ProposalCrypt on your PC

Automatically remove ProposalCrypt by downloading an advanced anti-malware program

1. Remove ProposalCrypt with SpyHunter Anti-Malware Tool and back up your data
2. Restore files encrypted by ProposalCrypt
Optional: Using Alternative Anti-Malware Tools

Berta Bilbao

Berta is the Editor-in-Chief of SensorsTechForum. She is a dedicated malware researcher, dreaming for a more secure cyber space.

More Posts - Website

Share on Facebook Share
Loading...
Share on Twitter Tweet
Loading...
Share on Google Plus Share
Loading...
Share on Linkedin Share
Loading...
Share on Digg Share
Share on Reddit Share
Loading...
Share on Stumbleupon Share
Loading...
Please wait...

Subscribe to our newsletter

Want to be notified when our article is published? Enter your email address and name below to be the first to know.