MindSystem Ransomware

What is MindSystem Ransomware?

It looks like MindSystem Ransomware might be an educational ransomware, but just like other file-encrypting programs created to demonstrate how such malware works, it may fall into cyber criminals’ hands. Thus, the chances are it could be later modified and distributed for money extortion. This is why we believe it might be useful to get to know MindSystem Ransomware better. If you read our report, you will learn not only about the malicious program’s working manner but also how it could be erased if it manages to settle in. In such case, we highly recommend using our removal steps located below the text since the threat may disable a lot of computer’s tools, and it could be too difficult to restore them alone without any guidance.

How does MindSystem Ransomware work?

The current malware’s version is only after data on the C:\Users\User\Desktop directory. Therefore, your personal files located in other folders should be undamaged. What’s more, the malicious program might mark data located on the victim’s Desktop with a second extension named .mind. Then, MindSystem Ransomware could open a pop-up window called “MindSystem.” It should contain a single sentence saying “Hi, your computer have been locked by Legend-Modz. It looks like the pop-up window can be closed by clicking either the OK or X button.

At the same time, the infection may connect to the Internet without the user’s permission and download an image called file.jpg too. It is supposed to contain three sentences: “Your files has been encrypted by MindSystem Ransomware,” “To recover them, just use the decryptor with your unique key,” and “For education only! MindSystem 2017.” Our researchers at Anti-spyware-101.com did not notice the threat would drop a decryption tool, although it says it should in the second quoted sentence. As for the unique decryption key, it might be written down in a text document called key.txt; the user should be able to find it on his Desktop as well. If the application was created for educational purposes, it makes sense it does not ask you to pay any ransom.

However, like we said earlier, if its code ever ends up in cyber criminals’ hands, they could modify it and create their own version of this file-encrypting program, and if it would happen, we have no doubt the displayed ransom note would demand to pay a for the decryption tools. Keep it in mind there are no guarantees when dealing with hackers, so you should consider such option very carefully and remove the malicious application instantly if you do not wish to risk your savings.

How to remove MindSystem Ransomware?

Unfortunately, the encryption of the victim’s data is not all, since the malware should then disable the Explorer, Task Manager, Registry Editor, CMD, and other necessary computer tools or features. This might make it difficult for you to work on your computer; not to mention, you could be unable to erase MindSystem Ransomware until you enable at least a couple of the listed tools. The good news is our researchers know how to restore all of the disabled features, and you can learn it too if you have a look at the instructions located below. Once, you complete this task you should not forget to follow the last part of instructions to get rid of the malware manually or install a legitimate antimalware tool instead and leave the deletion task to it.

Enable both CMD and Registry Editor

1. Click Windows key+R.
2. Insert gpedit.msc and select OK to launch Local Group Policy Editor.
3. Navigate to User Configuration.
4. Select Administrative Templates and choose System.
5. Double-click Prevent access to the command prompt to create a policy.
6. Choose Enabled and press OK.
7. Double-click Prevent Access to registry editing tools to create another policy.
8. Choose Enabled and click OK.
9. Exit the Local Group Policy Editor.
10. Reboot the PC.

Enable other disabled functions and tools

1. Tap Windows key+R.
2. Insert Regedit and choose OK.
3. Go to the specific location: HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System
4. Find the listed value names one by one:
   DisableTaskMgr
   DisableLockWorkstation
   DisableChangePassword
   NoClose
   NoLogoff
5. Right-click each of the mentioned value names separately and pick Modify.
6. If their value data says 1 replace it with 0 to enable the disabled tools and functions and click OK.
7. Find these specific locations one by one:
   HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System
   HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer
8. Search for value names titled NoClose, right-click them and press Modify.
9. If their value data says 1 replace it with 0 and click OK.
10. Look for this particular directory: HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System
11. Find value names titled HideFastUserSwitching and EnableLUA.
12. Right-click the mentioned value names separately and select Modify.
13. If their value data says 1 replace it with 0 and click OK.
14. Exit Registry Editor.

Eliminate MindSystem Ransomware

1. Press Windows key+E.
2. Check these locations:
   C:\Users\User\Desktop
   C:\Users\User\Downloads
   C:\Users\User\AppData\Local\Temp
3. Identify the malware’s launcher.
4. Right-click the malicious file and tap Delete.
5. Exit File Explorer.
6. Empty Recycle bin.
7. Restart the computer again. Download Removal Tool100% FREE spyware scan and
   tested removal of MindSystem Ransomware*

Stop these MindSystem Ransomware Processes: