This is a new virus called "BrokenMind" which inrtroduced in 2009...

And this virus is very common now....

This virus have the syptoms like

1) Task Manager Disabled

2) Command Prompt Disabled

3) Regedit Disabled

4) Folder Options Hidden

5) When double clicking on infected Drives " Access Denied' Message appears..

6) A text file generates automattically on Desktop with an appology in Malayalam Language and asks to contact him at brokenmind.info@yahoo.com...

7) Internet explorer title changes into "Broken Mind...........Memories"

And this virus is can't detected by most common anti-virus softwares....

There are some processes which causes its working..

Broken.exe

Mind.exe

The paths of this files are..

• c:\windows\mind.exe
• c:\windows\broken.exe

• e:\mind.exe

These are hidden and can't delete these files....

And its registry activites are

• HKEY_CURRENT_USER\Software\Policies\Microsoft\MMC RestrictAuthorMode value:
• HKEY_CURRENT_USER\Software\Policies\Microsoft\MMC\{8FC0B734-A0E1-11D1-A7D3-0000F87571E3} Restrict_Run value:
• HKEY_CURRENT_USER\Software\Policies\Microsoft\MMC\{D70A2BEA-A63E-11D1-A7D4-0000F87571E3} Restrict_Run value:
• HKEY_CURRENT_USER\Software\Policies\Microsoft\MMC\{E12BBB5D-D59D-4E61-947A-301D25AE8C23} Restrict_Run value:
• HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer NoFolderOptions value:
• HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System DisableTaskMgr value:
• HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\System DisableCMD value:
• HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main Window Title ....BrokenMind....For Your Memories
• HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer NoDriveTypeAutoRun [REG_DWORD, value: 000000FF]
• HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System DisableRegistryTools value:
• HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows load C:\WINDOWS\broken.exe
• HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced Hidden value:
• HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced ShowSuperHidden value:
• HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced HideFileExt value:

Solution for this virus attack

This virus has 2 solutions..

First Solution

First we have to stop the 3 processes...

• Broken.exe
• Mind.exe
• Internet explorer Broken Mind..... Memories.exe

For Finding this we have to use a small tool Micro Hijack....

By using this we can find these 3 processes.....

We can fix it by this software...

Then delete the following files

• c:\windows\mind.exe
• c:\windows\broken.exe

• e:\mind.exe

Then use the next tool Remove Restrictions Tool (RRT).

And by this we can remove the highligted problems and then restart the system....

Then go to run and type "regedit"..

Then search and delete all occurances of "Broken.exe" and "Mind.exe"

Then search "brokenmind"...

Then edit "BrokenMind............Memories" and change it into "Internet Explorer"

Now ur system is free from broken mind virus..........

Alternate Solution

If ur system have still problem then follow this steps..........

Press "F8" continously while booting...

Then a selection window appears.

Select "Safe mode" from it...

If ur task manager is disabled follow the steps in this hub

http://hubpages.com/hub/Top-Virus-Solutions-for-Windows-XP

If ur task manager is okey, make sure that the following processes are not working....

• Broken.exe
• Mind.exe

Then go to "folder options".......

If that also not okey, go to the above link again....

If folder options is okey, then tick on "show hidden files" and unselect the two hide options below it..

Then press "Apply and "ok"

Then remove the following files..

• c:\windows\mind.exe
• c:\windows\broken.exe

• e:\mind.exe

Then go to run and type "regedit"..

Then search and delete all occurances of "Broken.exe" and "Mind.exe"

Then search "brokenmind"...

Then edit "BrokenMind............Memories" and change it into "Internet Explorer"

Now ur system is free from broken mind virus..........

[...ReGiN...]