PROTON Ransomware 🔐 (.PROTON File) — Removal Guide

The Proton virus belongs to the Xorist ransomware family. Malware of this type encrypts all user’s data on the PC (images, documents, excel tables, music, videos, etc) and adds its own extension to every file, creating the HOW TO DECRYPT FILES.txt text files in every directory which contains the encrypted files.

What is known about the Proton virus?

☝️ Proton is a Xorist family ransomware-type malicious agent.

Proton appends its specific .PrOToN extension to the title of every encrypted file. For example, a file entitled “photo.jpg” will be altered to “photo.jpg.PrOToN”. Just like the Excel table named “table.xlsx” will end up as “table.xlsx.PrOToN”, and so forth.

In each directory containing the encrypted files, a HOW TO DECRYPT FILES.txt file will be created. It is a ransom money note. It contains information about the ways of paying the ransom and some other remarks. The ransom note most probably contains a description of how to buy the decryption tool from the tamperers. You can obtain this tool after contacting [email protected] via email. That is basically the scheme of the crime.

Proton Summary:

The HOW TO DECRYPT FILES.txt document coming in package with the Proton malware states the following:

Hello

 

All your files have been encrypted
if you want to decrypt them you have to pay me 0.045 bitcoin.


Make sure you send the 0.045 bitcoins to this address:
bc1qygn239pmpswtge00x60ultpp6wymht64ggf5mk


If you don\'t own bitcoin, you can easily buy it from these sites:
www.coinmama.com
www.bitpanda.com
www.localbitcoins.com
www.paxful.com


You can find a larger list here:
hxxps://bitcoin.org/en/exchanges


After sending the bitcoin, contact me at this email address:
[email protected] with this subject: -
After the payment has been confirmed,
you will get decryptor and decryption keys!


You will also receive information on how to defend against another ransomware attack
and the most important thing is your security hole through which we entered.


Attention!
Do not try other cheaper decryption options because nobody and nothing can
decrypt your files without the keys generated for your server,
you will lose time, money and your files forever!

In the picture below, you can see what a folder with files encrypted by the Proton looks like. Each filename has the “.PrOToN” extension appended to it.

How did Proton ransomware end up on my PC?

There are plenty of possible ways of ransomware infiltration.

Nowadays, there are three most exploited methods for tamperers to have ransomware planted in your system. These are email spam, Trojan introduction and peer-to-peer networks.

• Another thing the hackers might try is a Trojan virus scheme. A Trojan is a program that gets into your PC disguised as something legal. Imagine, you download an installer of some program you want or an update for some program. However, what is unpacked reveals itself a harmful program that compromises your data. As the update file can have any title and any icon, you have to make sure that you can trust the source of the things you’re downloading. The best way is to use the software companies’ official websites.
• As for the peer networks like torrents or eMule, the threat is that they are even more trust-based than the rest of the Web. You can never know what you download until you get it. So you’d better be using trustworthy resources. Also, it is a good idea to scan the directory containing the downloaded items with the antivirus as soon as the downloading is done.

How do I get rid of ransomware?

It is important to note that besides encrypting your data, the Proton virus will most likely install Vidar Stealer on your machine to seize your credentials to different accounts (including cryptocurrency wallets). The mentioned program can derive your logins and passwords from your browser’s auto-filling cardfile.

How do I avoid ransomware infection?

Proton ransomware has no endless power, neither does any similar malware.

You can armour your PC from ransomware injection in three easy steps:

• Ignore any letters from unknown senders with unknown addresses, or with content that has nothing to do with something you are expecting (how can you win in a money prize draw without even taking part in it?). In case the email subject is more or less something you are waiting for, check all elements of the suspicious email carefully. A hoax email will always have a mistake.
• Never use cracked or untrusted programs. Trojans are often shared as an element of cracked products, most likely under the guise of “patch” which prevents the license check. Understandably, untrusted programs are very hard to distinguish from reliable software, as trojans sometimes have the functionality you need. Try to find information on this program on the anti-malware forums, but the optimal way is not to use such programs at all.

FAQ

🤔 How can I open “.PrOToN” files?Is it possible to open“.PrOToN” files?

There’s no way to do it, unless the files “.PrOToN” files are decrypted.

🤔 The encrypted files are very important to me. How can I decrypt them quickly?

If the “.PrOToN” files contain some really important information, then you probably have them backed up. Otherwise, you might try to employ System Restore. The only question is whether you have saved any Restore Points that would be helpful now. There are other ways to beat ransomware, but they take time.

🤔 What to do if the Proton ransomware has blocked my computer and I can’t get the activation key.

🤔 What can I do right now?

Many of the encrypted files might still be within your reach

• If you sent or received your critical files through email, you could still download them from your online mailbox.
• You might have shared photographs or videos with your friends or relatives. Just ask them to give those pictures back to you.
• If you have initially downloaded any of your files from the Internet, you can try downloading them again.
• Your messengers, social media pages, and cloud drives might have all those files too.
• It might be that you still have the needed files on your old PC, a laptop, cellphone, memory stick, etc.

USEFUL TIP: You can use file recovery programs² to get your lost data back since ransomware encrypts the copies of your files, removing the original ones. In the video below, you can learn how to recover your files with PhotoRec, but be advised: you won’t be able to do it before you eradicate the ransomware itself with an anti-malware program.

1. My files are encrypted by ransomware, what should I do now?
2. Here’s the list of Top 10 Data Recovery Software Of 2023.