Skip to main content

Petya Ransomware Vaccine: This Single File Will Protect You From Latest Attack


petya ransomware vaccine fix
A security researcher has found a fix for the latest Petya Ransomware attack. For now, you can vaccinate your system in seconds by creating a particular file. If Petya finds that file on the disk, it stops the encryption business. Please note that users need to create this
file independently on each computer and it doesn’t fix things globally like WannaCry killswitch.
Yesterday we reported about the deadly Petya ransomware which exploits Eternal Blue vulnerability, the same exploit which was used by the creators of WannaCry exploit. For those who don’t know, Eternal Blue was designed by NSA and leaked by Shadow Brokers. The ransomware has already affected multiple countries like Ukraine, Russia, Poland, Germany, etc.
Earlier it was believed that the current malware is a variant of the older Petya ransomware, which made headlines last year. However, after further analysis, Kaspersky confirmed that it’s a new infection and they labeled it as “NotPetya.”
The working of Petya is a lot different from its other ransomware counterparts. This malware waits for about 10-60 minutes after the infection and then reboots the system using “at” or “schtasks” and “shutdown.exe” utilities. After the reboot, Petya starts encrypting MFT table in NTFS partitions and overwrites the MBR with the folder that contains ransom notes.
You can read more about Petya ransomware’s working here at Kaspersky’s Securelist blog.

How to enable Petya ransomware fix/vaccine?

Security researcher Amit Serper has found a way to prevent the Petya/NotPetya ransomware, according to a report from Bleeping Computer.
As this ransomware has made an appearance around WannaCry’s timeline, the researchers believed that there might be some killswitch domain to take care of Petya’s wrath. However, after analyzing its inner working, Serper found that Petya ransomware would cease its encryption routine if it finds a local file on disk. His finding has been confirmed by other security researchers too.
To make sure that your computer is vaccinated against Petya, you should create a file called perfc in C:\Windows folder and make it read only. Here’s how to do it —
  1. To do so, you need to first enable Windows extensions by opening Folder Options. There, uncheck the Hide extensions for known file types option.
  2. Now open C:\Windows folder and find the notepad.exe program. Select it using left-click, press Ctrl+C to copy it and use Ctrl+V to paste it.
  3. After this, a new notepad – copy.exe file will be created. Now rename this file as perfc and hit Enter. You’ll be shown a prompt that’ll ask you if you’re sure to rename it. Choose Yes and continue.
  4. Now, to make the file read-only, right-click on the file and select Properties.
  5. In the perfc Properties window, look for a Read-only checkbox at the bottom. Check it and click on Apply and then OK.
That’s all you need to do for making sure that you’re protected against Petya ransomware. Please note that it isn’t like a WannaCry killswitch that took care of the ransomware globally. This vaccine is applicable to a single computer on which it’s applied.
So, did you find this article on Petya ransomware vaccine helpful? Share your views in the comments.

Comments

WHAT'S HOT

Fappening 2.0 Continues: Modern Family Actress Sarah Hyland Has Become The Latest Victim Of Notorious Hackers [Private Photos, Video Leaked]

Modern Family actress Sarah Hyland has become the latest victim of notorious hackers. Her private pictures and video have been posted online on infamous website Celeb Jihad. According to media sources, Sarah’s lawyers are planning to take legal action against the websites who choose to publish the leaked material. Meanwhile, the actual powers behind the leak are unknown.

Samsung Overtakes Fitbit In Wearable Sales For First Time

Fitbit has been a top competitor on the global wearable market for a long time, but the South Korea giant Samsung managed to steal the silver crown of the wearable market from Fitbit. According to Strategy Analytics, Samsung gained the

Supermassive Black Holes Found Orbiting Each Other For The First Time

Image Credit: UCR Researchers from Stanford University have identified super-massive binary black holes at the center of Galaxy 0402+379 about 750 billion light years away. The two of the black holes are just 24 light years apart and one of them is orbiting the other. This is the first

Owners Of The Samsung Gear S3 In The United Kingdom Have Finally Received A Software Update That Enables Support For Samsung Pay

Owners of the Samsung Gear S3 in the United Kingdom have finally received a software update that enables support for Samsung Pay. Starting today, users will be able to use the Gear S3 smartwatch to make payments on all contactless