Skip to main content

Petya Ransomware Vaccine: This Single File Will Protect You From Latest Attack


petya ransomware vaccine fix
A security researcher has found a fix for the latest Petya Ransomware attack. For now, you can vaccinate your system in seconds by creating a particular file. If Petya finds that file on the disk, it stops the encryption business. Please note that users need to create this
file independently on each computer and it doesn’t fix things globally like WannaCry killswitch.
Yesterday we reported about the deadly Petya ransomware which exploits Eternal Blue vulnerability, the same exploit which was used by the creators of WannaCry exploit. For those who don’t know, Eternal Blue was designed by NSA and leaked by Shadow Brokers. The ransomware has already affected multiple countries like Ukraine, Russia, Poland, Germany, etc.
Earlier it was believed that the current malware is a variant of the older Petya ransomware, which made headlines last year. However, after further analysis, Kaspersky confirmed that it’s a new infection and they labeled it as “NotPetya.”
The working of Petya is a lot different from its other ransomware counterparts. This malware waits for about 10-60 minutes after the infection and then reboots the system using “at” or “schtasks” and “shutdown.exe” utilities. After the reboot, Petya starts encrypting MFT table in NTFS partitions and overwrites the MBR with the folder that contains ransom notes.
You can read more about Petya ransomware’s working here at Kaspersky’s Securelist blog.

How to enable Petya ransomware fix/vaccine?

Security researcher Amit Serper has found a way to prevent the Petya/NotPetya ransomware, according to a report from Bleeping Computer.
As this ransomware has made an appearance around WannaCry’s timeline, the researchers believed that there might be some killswitch domain to take care of Petya’s wrath. However, after analyzing its inner working, Serper found that Petya ransomware would cease its encryption routine if it finds a local file on disk. His finding has been confirmed by other security researchers too.
To make sure that your computer is vaccinated against Petya, you should create a file called perfc in C:\Windows folder and make it read only. Here’s how to do it —
  1. To do so, you need to first enable Windows extensions by opening Folder Options. There, uncheck the Hide extensions for known file types option.
  2. Now open C:\Windows folder and find the notepad.exe program. Select it using left-click, press Ctrl+C to copy it and use Ctrl+V to paste it.
  3. After this, a new notepad – copy.exe file will be created. Now rename this file as perfc and hit Enter. You’ll be shown a prompt that’ll ask you if you’re sure to rename it. Choose Yes and continue.
  4. Now, to make the file read-only, right-click on the file and select Properties.
  5. In the perfc Properties window, look for a Read-only checkbox at the bottom. Check it and click on Apply and then OK.
That’s all you need to do for making sure that you’re protected against Petya ransomware. Please note that it isn’t like a WannaCry killswitch that took care of the ransomware globally. This vaccine is applicable to a single computer on which it’s applied.
So, did you find this article on Petya ransomware vaccine helpful? Share your views in the comments.

Comments

WHAT'S HOT

Amazon Cuts Huawei Watch 2 Price To $194.99

Huawei's latest smartwatch has received a temporary price cut in the United States. There is no word on how long the promotion will last, but those interested

This Medical Camera Can See Right Through Human Body

Now, a team at the University of Edinburgh has developed a medical camera that can see right through your body. This new camera works by detecting light sources inside the body, such as

Google Search About To Receive A New “Speed Test Tool”, Here Is How To Use It

I use the Speed Test tool by Ookla to check the speed of my broadband connection. Generally, I use Google Search to visit the website. But the last time when I Googled the term “speed test,” I didn’t have to go much further than the search result itself.

Microsoft Has Released The First Windows 10 Build 16353 For Insiders

As Fall Creators Update is nearing its release, Skip Ahead was announced last month. It enables fast ring users to continue receiving new features, though the RS_PRERELEASE