New global ransomware attack hits East Europe and spreading

COMPUTIAC said:

MBAM if you don't have it, get it.

Petya-esque ransomware is spreading across the world - Malwarebytes Labs | Malwarebytes Labs

Whew!!!!!

Zero-hour protection

Malwarebytes detected this ransomware in the zero hour, meaning those that have Malwarebytes Premium or our standalone anti-ransomware technology have been protected from the instant this attack began. Both Malwarebytes business users and consumers users are protected if they are using the latest version of the above products.

There are some instructions how to create perfc file in C:/Windows folder over at BleepingComputers:

www.bleepingcomputer.com | news/security/vaccine-not-killswitch-found-for-petya-notpetya-ransomware-outbreak

Basically, copying the Notepad.exe and renaming it to "perfc", than giving it "read only" permission.

I was checking out the Norse tracking map and Microsoft was sending out a lot of attacks to servers in Washington DC. It looks like DC is the main target right now. Norse Attack Map

Steve C said:

Beware of using the batch file in that link. It creates some other files including perfc.dat which Kaspersky Total Security promptly deleted.

Thanks for warning Steve. One can usually trust the guys at Bleeping Computers. Will check it out. Kaspersky could react to changes in Windows dir...

Edit: can't imagine what would trigger Kaspersky, except that it just reacts to creating files in C:\Windows..

There are just 3 files, filled with some text (don't delete this.. is a vaccine ...) named perfc, perfc.dll and perfc.somtething else

lx07 said:

but only if you don't use it to connect to you NAS or whatever of course...

It was patched in march so if you run Windows update you should be OK.

https://www.us-cert.gov/ncas/current...-Vulnerability

Not really..

"Petya uses the NSA Eternalblue exploit but also spreads in internal networks with WMIC and PSEXEC. That's why patched systems can get hit." Mikko Hypponen confirms, Chief Research Officer at F-Secure.

System is patched for original Eternalblue (WannyCry), but not for other exploits.

All major AV and Antimalware companies updated their software, so users are on the safe side by now. Industrial solutions are other story...