Remove SYSTEM ransomware virus (Restore .SYSTEM files)

Computer security professionals discovered a new variant of the CryptoMix ransomware that called SYSTEM virus. It appends the .SYSTEM extension to encrypted file names. This post will provide you with all the things you need to know about ransomware virus, how to remove SYSTEM ransomware virus from your PC system and how to recover all encrypted files for free.

The SYSTEM ransomware virus uses a strong encryption algorithm with a big key. When the virus encrypts a file, it will add the .SYSTEM extension to every encrypted file. Once the ransomware virus finished enciphering of all files, it will drop a file called “_HELP_INSTRUCTION.TXT” with guide on how to decrypt all encrypted files.

The SYSTEM ransomware offers to send an email with user’s ID number to:

• systemwall@keemail.me
• systemwall@protonmail.com
• systemwall@yandex.com
• systemwall1@yandex.com

The devs behind the SYSTEM ransomware encourages to make a payment in Bitcoins to get a key to decrypt personal files. Important to know, currently not possible to decrypt .SYSTEM files without the private key and decrypt application. If you choose to pay the ransom, there is no 100% guarantee that you can decrypt all files! If you do not want to pay for a decryption key, then you have a chance to recover encrypted personal files.

We advise you to remove SYSTEM ransomware virus ASAP, until the presence of the ransomware has not led to even worse consequences. You need to follow the step-by-step guide below that will help you to completely remove SYSTEM ransomware from your machine as well as restore encrypted personal files, using only few free tools.

Table of contents

1. What is SYSTEM ransomware virus
2. How to decrypt .SYSTEM files
3. How to remove SYSTEM ransomware
   • How to remove SYSTEM ransomware with Zemana Anti-malware
   • How to delete SYSTEM with Malwarebytes
   • Scan your PC system and get rid of SYSTEM virus with KVRT
4. Restoring files encrypted by SYSTEM ransomware
   • Restore .SYSTEM files with ShadowExplorer
   • Restore .SYSTEM files with PhotoRec
5. How to prevent your PC system from becoming infected by SYSTEM ransomware?
   • Run CryptoPrevent to protect your computer from SYSTEM ransomware
6. To sum up

What is SYSTEM ransomware virus

The SYSTEM ransomware is a variant of crypto viruses (malware which encrypt personal files and demand a ransom) from the CryptoMix family. It affects all current versions of Windows operating system such as Windows XP, Windows Vista, Windows 7, Windows 8, Windows 10. This ransomware virus uses a hybrid AES + RSA encryption mode to eliminate the possibility of brute force a key that will allow to decrypt encrypted photos, documents and music.

When the ransomware virus infects a PC, it uses system directories to store own files. To run automatically whenever you turn on your computer, SYSTEM ransomware creates a registry entry in Windows: sections HKCU \ Software \ Microsoft \ Windows \ CurrentVersion \ Run, HKCU \ Software \ Microsoft \ Windows \ CurrentVersion \ RunOnce, HKCU \ Software \ Microsoft \ Windows \ CurrentVersion \ Run, HKCU \ Software \ Microsoft \ Windows \ CurrentVersion \ RunOnce.

Immediately after the launch, the virus scans all available drives, including network and cloud storage, to determine which files will be encrypted. The virus uses the file name extension, as a method to define a group of files that will be subjected to encrypting. Encrypted almost all types of files, including common as:

.ntl, .7z, .x3f, .xld, .sum, .kf, .xmind, .menu, .z3d, .xls, .sav, .3ds, .ysp, .m4a, .dba, .pak, .layout, .ppt, .m3u, .xdb, .xy3, .xlsm, .odc, .tor, .dazip, .eps, .raf, .odp, .kdc, .webdoc, .cer, .hplg, .r3d, .re4, .snx, .map, .arw, .3fr, .rar, .zw, .cfr, .xbdoc, .yal, .docx, .fsh, .vcf, .wot, .bar, .css, .xlsm, .zdc, .syncdb, .mpqge, .gho, .ztmp, .bik, .wcf, .mov, .z, .xdl, .wmo, .wmv, .pkpass, .odt, .srw, .zip, .js, .xmmap, .d3dbsp, .rb, .sidn, .zif, .xlk, .mdf, .pptm, .wire, .apk, .wbm, .db0, .slm, .wmd, .wdb, .wpw, .w3x, .zip, .ybk, .wmv, .wpe, .zabw, .xar, .0, .mef, .p7c, .kdb, .vfs0, .cr2, .pst, .xxx, .jpeg, .wmf, .t12, .wpt, .mdb, .csv, .wav, .sis, .mp4, .odm, .wp4, .vpp_pc, .wbk, .svg, .wp6, .tax, .py, .wbmp, .lrf, .odb, .bc6, .wpd, .iwi, .pptx, .pem, .wri, .das, .xlsx, .wdp, .gdb, .x3f, .sid, .hkx, .xyp, .webp, .desc, .cdr, .dmp, .dng, .wsc, .hkdb, .mddata, .1st, .x, .3dm, .wotreplay, .wp5, .ltx, .wsd, .vpk, .dcr, .ods, .docm, .xpm, .itdb, .xbplate, .wp, .itl, .rofl, .mlx, .t13, .wgz, .cas, .lvl, .raw, .wsh, .xlsx, .sidd, .flv, .xx, .sql, .bkf, .vtf, .iwd, .wma, .jpe, .sr2, .ws, .wp7, .lbf, .ncf, .sie, .big, .forge, .mcmeta, .orf, .p12, .srf, .arch00, .litemod, .xml, .indd, .crw, .pef, .asset, .vdf, .crt, .xwp, .1, .wps, .nrw, .bkp, .ptx, .txt, .accdb, .xll, .rgss3a, .wpg, .jpg, .hvpl, .pdf, .xf, .dwg, .mdbackup, .xlgc, .y, .wn, .bsa, .wma, .wbc, .upk, wallet, .bc7, .zdb, .xyw, .wbd, .blob, .der, .wpl, .bay, .p7b, .xlsb, .sb, .epk, .wps, .qic, .psk, .pfx, .zi, .avi, .fos, .ff, .erf, .png, .wpb, .mrwref, .rwl, .esm, .pdd, .wbz, .dxg, .wpa, .wpd, .ai, .psd

Once a file is encrypted, its extension modified to .SYSTEM. Next, the virus creates a file called “_HELP_INSTRUCTION.TXT”. This file contain a note on how to decrypt all encrypted files. You can see an one of the variants of the ransom note below:

    Hello!

    Attention! All Your data was encrypted!

    For specific informartion, please send us an email with Your ID number:

    systemwall@keemail.me

    systemwall@protonmail.com

    systemwall@yandex.com

    systemwall1@yandex.com

    Please send email to all email addresses! We will help You as soon as possible!

    IMPORTANT: DO NOT USE ANY PUBLIC SOFTWARE! IT MAY DAMAGE YOUR DATA FOREVER!

The SYSTEM ransomware actively uses scare tactics. It is trying to force a user of the infected machine, do not hesitate to pay a ransom, in an attempt to recover their personal files.

How to decrypt .SYSTEM files

Currently there is no available solution to decrypt .SYSTEM files, but you have a chance to restore encrypted files for free. The virus repeatedly tells the victim that uses a strong encryption algorithm with a big key. What does it mean to decrypt the files is impossible without the private key. Use a “brute forcing” is also not a way because of the big length of the key. Therefore, unfortunately, the only payment to the creators of the SYSTEM ransomware entire amount requested – the only method to try to get the decryption key and decrypt all your files.

There is absolutely no guarantee that after pay a ransom to the authors of the SYSTEM virus, they will provide the necessary key to decrypt your files. In addition, you must understand that paying money to the cyber criminals, you are encouraging them to create a new ransomware virus.

How to remove SYSTEM ransomware

The following instructions will help you to get rid of SYSTEM virus and other malware. Before doing it, you need to know that starting to remove the virus, you may block the ability to decrypt files by paying makers of the ransomware virus requested ransom. Zemana Anti-malware, KVRT and Malwarebytes Anti-malware can detect different types of active ransomwares and easily get rid of it from your machine, but they can not recover encrypted photos, documents and music.

How to remove SYSTEM ransomware with Zemana Anti-malware

We suggest you to run the Zemana Anti-malware which are completely clean your machine of this ransomware. Moreover, the tool will allow you to remove potentially unwanted software, malware, toolbars and ad-supported software that your machine can be infected too.

Installing the Zemana is simple. First you’ll need to download Zemana Free by clicking on the following link.

When downloading is done, start it and follow the prompts. Once installed, the Zemana Anti Malware will try to update itself and when this procedure is finished, click the “Scan” button to detect SYSTEM virus related files, folders and registry keys.

This process can take quite a while, so please be patient. When a malware, adware or potentially unwanted applications are found, the number of the security threats will change accordingly. All detected items will be marked. You can get rid of them all by simply click “Next” button.

The Zemana will remove SYSTEM ransomware and other kinds of potential threats such as malicious software and potentially unwanted software and add threats to the Quarantine.

How to delete SYSTEM ransomware with Malwarebytes

We suggest using the Malwarebytes Free that are completely clean your computer of the ransomware. The free tool is an advanced malware removal application developed by (c) Malwarebytes lab. This application uses the world’s most popular anti-malware technology. It’s able to help you remove ransomwares, potentially unwanted apps, malicious software, ‘ad supported’ software, toolbars, ransomware and other security threats from your machine for free.

MalwareBytes Anti Malware can be downloaded from the following link. Save it on your Desktop.

When the download is finished, close all software and windows on your computer. Open a directory in which you saved it. Double-click on the icon that’s called mb3-setup as shown on the image below.

When the setup begins, you will see the “Setup wizard” which will help you setup Malwarebytes on your machine.

Once installation is finished, you’ll see window as displayed below.

Now click the “Scan Now” button for scanning your computer for the SYSTEM ransomware and other kinds of potential threats such as malware and potentially unwanted applications. A system scan can take anywhere from 5 to 30 minutes, depending on your PC. While the MalwareBytes Anti-Malware (MBAM) is checking, you can see how many objects it has identified either as being malware.

After MalwareBytes AntiMalware completes the scan, the results are displayed in the scan report. Make sure all items have ‘checkmark’ and click “Quarantine Selected” button.

The Malwarebytes will now start to delete SYSTEM virus related files, folders and registry keys. Once the procedure is done, you may be prompted to reboot your PC.

The following video explains guidance on how to remove browser hijacker, ad-supported software and other malicious software with MalwareBytes AntiMalware.

Scan your PC system and get rid of SYSTEM virus with KVRT

KVRT is a free removal tool that can scan your system for a wide range of security threats like the SYSTEM ransomware virus, adware, PUPs as well as other malicious software. It will perform a deep scan of your computer including hard drives and Microsoft Windows registry. Once a malicious software is detected, it will help you to remove all found threats from your system with a simple click.

Download Kaspersky virus removal tool (KVRT) on your MS Windows Desktop by clicking on the link below.

Once downloading is finished, double-click on the Kaspersky virus removal tool icon. Once initialization process is finished, you’ll see the Kaspersky virus removal tool screen as on the image below.

Click Change Parameters and set a check near all your drives. Press OK to close the Parameters window. Next press Start scan button to perform a system scan for the SYSTEM ransomware virus and other known infections. Depending on your machine, the scan may take anywhere from a few minutes to close to an hour. When a malware, ad-supported software or PUPs are detected, the count of the security threats will change accordingly.

Once the checking is done, KVRT will display a list of found threats as shown in the figure below.

Make sure all threats have ‘checkmark’ and click on Continue to begin a cleaning procedure.

Restoring files encrypted by SYSTEM ransomware

In some cases, you can recover files encrypted by SYSTEM ransomware. Try both methods. Important to understand that we cannot guarantee that you will be able to recover all encrypted documents, photos and music.

Restore .SYSTEM files with ShadowExplorer

If automated backup (System Restore) is enabled, then you can use it to recover all encrypted files to previous versions.

Download ShadowExplorer on your Microsoft Windows Desktop from the link below.

After the download is finished, open a directory in which you saved it. Right click to ShadowExplorer-0.9-portable and select Extract all. Follow the prompts. Next please open the ShadowExplorerPortable folder like below.

Double click ShadowExplorerPortable to start it. You will see the a window as displayed on the screen below.

In top left corner, choose a Drive where encrypted files are stored and a latest restore point as on the image below (1 – drive, 2 – restore point).

On right panel look for a file that you want to restore, right click to it and select Export as shown in the following example.

Restore .SYSTEM files with PhotoRec

Before a file is encrypted, the SYSTEM ransomware makes a copy of this file, encrypts it, and then deletes the original file. This can allow you to restore your documents, photos and music using file recover applications such as PhotoRec.

Download PhotoRec by clicking on the following link. Save it to your Desktop.

After the download is complete, open a directory in which you saved it. Right click to testdisk-7.0.win and select Extract all. Follow the prompts. Next please open the testdisk-7.0 folder like below.

Double click on qphotorec_win to run PhotoRec for MS Windows. It will show a screen as shown on the image below.

Choose a drive to recover like below.

You will see a list of available partitions. Choose a partition that holds encrypted photos, documents and music as shown on the screen below.

Click File Formats button and specify file types to recover. You can to enable or disable the restore of certain file types. When this is finished, press OK button.

Next, click Browse button to select where recovered personal files should be written, then press Search.

Count of restored files is updated in real time. All recovered personal files are written in a folder that you have selected on the previous step. You can to access the files even if the restore process is not finished.

When the recovery is complete, click on Quit button. Next, open the directory where restored documents, photos and music are stored. You will see a contents as displayed below.

All recovered files are written in recup_dir.1, recup_dir.2 … sub-directories. If you are searching for a specific file, then you can to sort your recovered files by extension and/or date/time.

How to prevent your PC system from becoming infected by SYSTEM ransomware?

Most antivirus software already have built-in protection system against the ransomware virus. Therefore, if your personal computer does not have an antivirus application, make sure you install it. As an extra protection, use the CryptoPrevent.

Run CryptoPrevent to protect your computer from SYSTEM ransomware

Download CryptoPrevent on your PC by clicking on the following link.

www.foolishit.com/download/cryptoprevent/

Run it and follow the setup wizard. Once the installation is complete, you will be shown a window where you can select a level of protection, as shown in the figure below.

Now click the Apply button to activate the protection.

To sum up

Now your PC system should be free of the SYSTEM ransomware. Uninstall KVRT and MalwareBytes AntiMalware. We recommend that you keep Zemana Anti Malware (to periodically scan your machine for new malware). Probably you are running an older version of Java or Adobe Flash Player. This can be a security risk, so download and install the latest version right now.

If you are still having problems while trying to remove SYSTEM virus from your personal computer, then ask for help in our Spyware/Malware removal forum.