The Petya ransomware just got a whole lot worse

Borg 386 · 14 May 2016

Make back ups before it strikes.....

The Petya ransomware now bundles a second file-encrypting program for cases where it cannot replace a computer's master boot record to encrypt its file table.

Before encrypting the MFT, Petya replaces the computer's master boot record (MBR), which contains code that initiates the operating system's bootloader. Petya replaces it with its own malicious code that displays the ransom note and leaves computers unable to boot.

However, in order to overwrite the MBR after it infects a computer, the malware needs to obtain administrator privileges. It does so by asking users for access via the User Account Control (UAC) mechanism in Windows.

In previous versions, if Petya failed to obtain administrator privileges, it stopped the infection routine. However, in such a case, the latest variant installs another ransomware program, dubbed Mischa, that begins to encrypt users' files directly, an operation that doesn't require special privileges.

The Petya ransomware just got a whole lot worse | PCWorld

Cliff S · 14 May 2016

I'm scared now!
It'll take me 25 minutes to reimage 2 SSDs(256GB & 1TB) and one 2TB HDD

Hopachi · 14 May 2016

Cliff S said:

I'm scared now!
It'll take me 25 minutes to reimage 2 SSDs(256GB & 1TB) and one 2TB HDD

Yes Cliff, but there are still enough pc's to target since a lot of users don't backup.

axe0 · 14 May 2016

There are also folks who don't backup their backup and leave the original backup on the main pc.
I'm the sort of a guy that backups the backup of the backup :)

Cliff S · 14 May 2016

axe0 said:

There are also folks who don't backup their backup and leave the original backup on the main pc.
I'm the sort of a guy that backups the backup of the backup :)

I just make one major backup of all 3 disks every couple of months(or like I will tomorrow, because I changed my disks(got a new 1TB 850EVO to replace a 128 840 PRO today:)) and I did some partition moving, and adjusting for the new size) to an external HDD, that sits in the closet..
The rest of the time, after any new software installs, and before, then a few days after, any major updates(software and/or OS), I just make an image to my 2TB HDD of the C: disk, incase something goes haywire.

ArazelEternal · 15 May 2016

This is why I always made a weekly backup when I ran Windows. That way it was just as simple as restoring the backup.

jimbo45 · 16 May 2016

Hi there

I think I've said this on the Forum "Ad Nauseam".

Take regular backups with a bootable backup program e.g Free Macrium -- easily enough done -- and ensure they are clean backups of course.
Then if any problem - just wipe HDD and restore image.

My data I store on a NAS and that data is updated when required manually by me - Windows doesn't have direct write access anyway to those drives -- and it's XFS file format which Windows can't do anything about.

The NAS data I back up also sporadically on some external HDD's so even in TOTAL disaster I can recover.

To those of you with NAS boxes -- think also about backup on those too from time to time -- I really for example wouldn't like to re-create 3 TB or so of music files !!!! - and I don't believe streaming will replace local music either -- lots of times you want stuff not easily available on services like spotify etc and especially if you like uncompressed HQ music (FLAC, WAV etc).

RAID / NAS drives can fail too -- RAID prevents total disaster if you choose the right option - but you should think about these things too.

A couple of cheap external 2 TB HDD's is good for that type of backup. You don't need to back that type of stuff up very often anyway. After initial backup just incrementals / differentials is all that is required. For the OS though I always Image the entire OS.

I did have to restore / re-create a 6TB NAS array (data about 3 TB) when an old drive on a RAID array went totally Bonkers -- took about 5 hrs from 3 X 2 TB passport size USB HDD's but job was done OK - so as a previous poster says - even have a Backup of the Backup --you might never need it but I'm glad I had it !!!!.

Cheers
jimbo