SecretSystem Ransomware

SecretSystem Ransomware may show a fake Windows update window to confuse the victim and prevent him from turning off the computer to stop the infection. During the time the fake update screen is shown the malware is supposed to locate valuable data on the infected device and encrypt it with a secure cryptosystem. However, it looks like at the moment the malicious application does not work properly because while our researchers were testing SecretSystem Ransomware, it did not encrypt any files. If you encountered this threat, we advise you to restart the computer in Safe Mode and check whether your data was locked or not. Afterward, our specialists recommend erasing the malicious application from the system to keep it clean and secure. For this reason, we are placing manual deletion instructions at the end of the text, but first, it would be advisable to read the rest of the report as it may help you learn how to avoid threats alike.

After the system gets infected, the first and most important question is how did it happen? According to our researchers infections like SecretSystem Ransomware are often distributed through Spam emails or malicious data downloaded from the Internet, e.g. software installers, updates, and so on. Any email attachments, installers, or other files that come from unknown or unreliable sources, e.g. file-sharing sites, should be checked before opening them, which you could do with a trustworthy antimalware tool. To stay away from malicious applications alike or other threats you should also avoid visiting potentially harmful web pages. Additionally, we advise you to pay attention to the content you download or interact with as it would be best to avoid questionable freeware software or programs that are spread not through their official distribution websites, e.g. torrent sites.

As it was said earlier, SecretSystem Ransomware should firstly show a fake Windows update window. Researchers say it is supposed to appear right after the user launches the malware’s installer. The message on it should claim the operating system is working on updates and ask you to wait till it finishes. There are a couple of possibilities why the infection does not encrypt any data at the moment. For instance, the malicious application could be still in the development stage as its creators might be only testing it. The other possibility is that the malware is already finished, but for some reason, its server is down.

Furthermore, after showing the fake updates window, the threat locks the screen by displaying a warning titled “Attention All Your Files are Encrypted by SecretSystem.” It warns not to turn off the computer and pay a ransom of 500 US dollars. Later, the infection might show a pop-up urging users to put up with demands. The strange part is that SecretSystem Ransomware’s creators do not provide any Bitcoin address. Because of this, it becomes impossible to pay the ransom even if the victim would be willing to do so. Of course, we would advise against such actions as in such situations there are no guarantees and users might get tricked. Since the malware locks the screen, you cannot see if the data on the computer was actually locked.

If the threat did not block the Task Manager, you could kill its process with it and unlock the screen. Without the Task Manager, the only other good option left is to restart the computer in Safe Mode. Users who do not know how to do this can follow the removal instructions placed below the article. They will show you how to get rid of SecretSystem Ransomware too. Naturally, manual deletion might be too complicated for less experienced users; thus, if you do not have much experience with malicious applications, you may want to employ a reliable antimalware tool instead. If you chose this option, install the tool of your choice on the infected device. Then run a system scan and wait for the report to show up. To remove the ransomware and other possible threats you should click the deletion button, and the antimalware tool would take care of them for you.

Restart your PC in Safe Mode with Networking

Windows 8/Windows 10

1. Press Win+I and choose the Power button.
2. Click and hold the Shift key and press Restart.
3. Pick Troubleshoot and select Advanced Options.
4. Choose Startup Settings and press Restart.
5. Click the F5 key and restart the system.

Windows XP/Windows Vista/Windows 7

1. Go to Start, select Shutdown options and click Restart.
2. Press and hold the F8 key when the PC is restarting.
3. Choose Safe Mode with Networking from Advanced Boot Options window.
4. Click Enter and log on.

Remove SecretSystem Ransomware from the system

1. Press Win+E.
2. Copy and paste listed directories separately into the Explorer:
   %TEMP%
   %USERPROFILE%\desktop
   %USERPROFILE%\downloads
3. Search for the malicious file opened before the ransomware affected the system.
4. Right-click the suspicious file and press Delete.
5. Exit your File Explorer.
6. Empty the Recycle bin.
7. Reboot the system.