Welcome to DU! The truly grassroots left-of-center political community where regular people, not algorithms, drive the discussions and set the standards. Join the community: Create a free account Support DU (and get rid of ads!): Become a Star Member Latest Breaking News Editorials & Other Articles General Discussion The DU Lounge All Forums Issue Forums Culture Forums Alliance Forums Region Forums Support Forums Help & Search

Earth Bound Misfit

(3,562 posts)
6. Booby trappede-mails with malicious Office doc attachments
Wed Jun 28, 2017, 06:25 PM
Jun 2017

Lawrence Abrams (aka Grinler) owner/admin @Bleepingcomputer.com posted a "vaccination" for this Petya/not Petya whatever it is:

https://www.bleepingcomputer.com/news/security/vaccine-not-killswitch-found-for-petya-notpetya-ransomware-outbreak/

Because of the ransomware's global outreach, many researchers flocked to analyze it, hoping to find a loophole in its encryption or a killswitch domain that would stop it from spreading, similar to WannaCry.

While analyzing the ransomware's inner workings, Serper was the first to discover that NotPetya would search for a local file and would exit its encryption routine if that file already existed on disk.

The researcher's initial findings have been later confirmed by other security researchers, such as PT Security, TrustedSec, and Emsisoft.

This means victims can create that file on their PCs, set it to read-only, and block the NotPetya ransomware from executing.

Recommendations

0 members have recommended this reply (displayed in chronological order):

Latest Discussions»Help & Search»Computer Help and Support»Tuesdays massive ransomwa...»Reply #6