Soft2Secure

Promorad2 (promok/promorad) virus file extensions decryptor and removal

What is the Promorad2 (Promok, Promorad) ransomware?

Promorad2 (promok) is a hallmark noted by the users who have their computer data scrambled. The encryption is to be blamed on the ransomware. According to the classification attempts available from the websites reviewing ransomware on a regular basis, this is a version of STOP ransom trojan.

Nearly any encryption-for-ransom includes a growing set of extensions. The extensions released first typically become family names. That is, Promorad2 represents the family of ransomware which was adding .STOP and .DJVU extensions in its initial releases, hence .STOP is the family name. The follow-up includes a number of other extensions and minor modifications in the body of the virus.

To that end, .STOP/.DJVU splits into two groups, exactly into .STOP and .DJVU. The .DJVU includes three sub-groups, one of which is .promorad2. This subgroup includes the .promok and .promorad ransom Trojans. Promorad2, just like any other virus of its family, applies AES cypher to encrypt data. AES stands for Advanced Encryption Standard, a symmetric encryption algorithm. That implies the same key to be used for both decryption and encryption. Obviously enough, the key has already processed the data to have it encrypted. That is, the ransomware introduced it into the memory of the devices it hacked. It goes without saying that such an introduction provides adequate measures to keep the key secret. It is meant to be sold to the legitimate holders of the data by the criminals deploying the attack. However, the attack needs to have the key integrated into the system to be compromised. This is a chance for IT security to interfere intercepting the key.

Removal of STOP/DJVU encryption is available for some of its versions with the private key intercepted as outlined above. This chiefly applies to the offline key used by malicious encryptor. Online key exposure to the process is insufficient to successfully derive it for decryption purposes. Promorad2 ransomware decryption is not available with such interception-based decryption, at least as of now. The crooks behind the attack demand payment for the private key. It is payable in bitcoins. The price is up to USD 600.

Promorad2 is a threat to any operating system. Latest reports on its invasion originate from Mac users though. The victims also report the infection affects all the files around. USB and network memory are under attack.

Apart from decrypting your data, it is essential to get rid of Promorad2 (Promok) ransomware. This comprehensive approach underpins the removal guide as available below.

Promorad2 file automatic removal

Extermination of this ransomware can be efficiently accomplished with reliable security software. Sticking to the automatic cleanup technique ensures that all components of the infection get thoroughly wiped from your system.

1. Download recommended security utility and get your PC checked for malicious objects by selecting the Start Computer Scan option

Download Promorad2 ransomware remover

2. The scan will come up with a list of detected items. Click Fix Threats to get the file and related infections removed from your system. Completing this phase of the cleanup process is most likely to lead to complete eradication of the plague proper. Now you are facing a bigger challenge – try and get your data back.

Methods to restore files encrypted by Promorad2 file

Workaround 1: Use file recovery software

It’s important to know that the Promorad2 file creates copies of your files and encrypts them. In the meanwhile, the original files get deleted. There are applications out there that can restore the removed data. You can utilize tools like Stellar Data Recovery for this purpose. The newest version of the file under consideration tends to apply secure deletion with several overwrites, but in any case this method is worth a try.

Download Stellar Data Recovery Professional

Workaround 2: Make use of backups

First and foremost, this is a great way of recovering your files. It’s only applicable, though, if you have been backing up the information stored on your machine. If so, do not fail to benefit from your forethought.

Workaround 3: Use Shadow Volume Copies

In case you didn’t know, the operating system creates so-called Shadow Volume Copies of every file as long as System Restore is activated on the computer. As restore points are created at specified intervals, snapshots of files as they appear at that moment are generated as well. Be advised this method does not ensure the recovery of the latest versions of your files. It’s certainly worth a shot though. This workflow is doable in two ways: manually and through the use of an automatic solution. Let’s first take a look at the manual process.

• Use the Previous Versions feature
  The Windows OS provides a built-in option of recovering previous versions of files. It can also be applied to folders. Just right-click on a file or folder, select Properties and hit the tab named Previous Versions. Within the versions area, you will see the list of backed up copies of the file / folder, with the respective time and date indication. Select the latest entry and click Copy if you wish to restore the object to a new location that you can specify. If you click the Restore button, the item will be restored to its original location.
  
• Apply Shadow Explorer tool

  This workflow allows restoring previous versions of files and folders in an automatic mode rather than by hand. To do this, download and install the Shadow Explorer application. After you run it, select the drive name and the date that the file versions were created. Right-click on the folder or file of interest and select the Export option. Then simply specify the location to which the data should be restored.
  

Verify whether Promorad2 file has been completely removed

Again, ransomware removal alone does not lead to the decryption of your personal files. The data restore methods highlighted above may or may not do the trick, but the file itself does not belong inside your computer. Incidentally, it often comes with other file, which is why it definitely makes sense to repeatedly scan the system with automatic security software in order to make sure no harmful remnants of this file and associated threats are left inside Windows Registry and other locations.

5/5 (2)