MindSystem Ransomware

MindSystem Ransomware is probably one of the strangest ransomware application that we have encountered in the last few days. The malware’s presented ransom note claims it is only for educational purposes and so it does not ask to make any payments as other similar infections would most likely do. To our surprise, it might even drop a decryption key needed to restore its enciphered files. However, the problem is the malicious program does not provide a decryption tool to insert such a key. Thus, at least for the time being, it does not seem there is a way to unlock enciphered data. To make matters worse, MindSystem Ransomware could disable most essential computer tools to stop you from using it normally or deleting the infection. For more details, we urge you to review the article first, and if you want to have the control of your device back, you should also follow the instructions available at the end of this text.

In truth, we do not know how widely MindSystem Ransomware could be distributed or if it is spread at all since there is not much information or reports about this threat yet. Nonetheless, we can tell you that often users receive such malware after clicking malicious pop-up ads, launching infected installers, installing fake software installers, etc. Moreover, a lot of ransomware applications are still being distributed through Spam emails; therefore, it is same important to be cautious with email attachments as it is crucial to be careful with files downloaded from unreliable web pages. Besides being more attentive, the user can guard his system against threats by installing a reliable antimalware tool too, so if you have not acquired it yet, it might be worth to consider such a tool.

The way the application is now, it should encrypt all files located in the %USERPROFILE%\Desktop directory. Each of the enciphered files might be marked with .mind extension, for example, wallpaper.jpg.mind, text.docx.mind, and so on. If we compare, MindSystem Ransomware with other threats from the same category we must say it targets a rather small area, since other similar malicious applications could encrypt all files on the computer or at least all private files belonging to the user. What we are trying to say is that if you do not keep a lot of files on your Desktop, the damage done by this malware might be not so huge. What could appear to be even more horrible is the inability to access particular computer’s tools. Apparently, the malicious application disables them soon after it enters the system.

Our researchers report, MindSystem Ransomware can disable the computer’s Task Manager, Registry Editor, Command Prompt (CMD), Explorer, Shut down button located on the Start menu, password change, etc. Many of these features can be enabled through the Registry Editor if you find particular paths and change specific values, but of course, to do this, you would need to be able to access Windows Registry First. Luckily, users can do so through a Windows feature called Group Policy settings. You should not worry if you have no idea how to use this tool as the instructions located below the text can guide you through the process. In fact, the removal steps can help you enable all other disabled features too and most importantly it will explain how to erase MindSystem Ransomware for good.

Even though it could seem like the malware already did all the damage it was able to do; it might be not all. Our specialists say the malicious application might also work as a keylogger and so put your privacy at risk. For this reason, experts encourage users not to leave the threat unattended and get rid of it as fast as possible. One way to delete it is to follow the last part of the instructions available below this text. If it seems too complicated users could download a reliable antimalware tool instead and use its automatic features to both detect and remove the infection from the system.

Enable Command Prompt (CMD) and Registry Editor

1. Press Windows key+R.
2. Type gpedit.msc and click Enter.
3. OnceLocal Group Policy Editor is opened go to User Configuration.
4. Access Administrative Templates and select System.
5. Find an option titled Prevent access to the command prompt.
6. Double-click it to create a policy.
7. Select Enabled and click OK.
8. Then locate an option called Prevent Access to registry editing tools.
9. Double-click it and select Enabled.
10. Click OK.
11. Exit the Local Group Policy Editor.
12. Restart the computer.

Enable the rest of disabled system features

1. Press Windows key+R.
2. Type Regedit and click OK.
3. Access the given directory: HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System
4. Look for the following value names:
   DisableTaskMgr
   DisableLockWorkstation
   DisableChangePassword
   NoClose
   NoLogoff
5. Right-click the listed value names separately and choose Modify.
6. Check their value data; if it says 1 replace it with 0 to enable Task manager, Password change, log off function, and some other functions.
7. Locate the following paths separately:
   HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System
   HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer
8. Look for value names called NoClose, right-click them and choose Modify.
9. Replace value data with 0 if it says 1 and click OK.
10. Find the given path: HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System
11. Locate value names called HideFastUserSwitching and EnableLUA, right-click them separately and select Modify.
12. Replace value data with 0 if it says 1 and click OK.
13. Exit Registry Editor.

Erase MindSystem Ransomware

1. Press Windows key+E.
2. Locate these paths:
   %TEMP%
   %USERPROFILE%\desktop
   %USERPROFILE%\downloads
3. Find the malicious file you may have opened when the system got infected.
4. Right-click the suspicious file and press Delete.
5. Exit your File Explorer.
6. Empty the Recycle bin.
7. Reboot the system.