Problem is, the prompt doesn't appear until the encryption has ended, the key has been sent to the servers (it's kind of complicated, it apparently tries to find servers on its own, I wonder if it can be fooled) and that key has been locally destroyed.

So, by the time the user is notified that there is malware on their PC, it's too late. People who know to detect viruses while they're running don't run attachments in the first place.