Bad Rabbit ransomware: A new variant of Petya is spreading

Steve C said:

What's the significance of Enable ValidateAdminCodeSignatures and does using it create other installation issues?

Exe has to be digitally signed, only less used apps do not have a certificate, it costs a lot of money. But you can still run them, just not with admin rights, most do not need them anyway. You can check properties for a certificate, if it does not have one, you will get an error. I have created a script to turn it on/off, when need and shortcuts like this.

Code:

reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v "ValidateAdminCodeSignatures" /t REG_DWORD /d "0" /f
start "" "E:\Software\Windows_Repair_Toolbox.lnk"
reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v "ValidateAdminCodeSignatures" /t REG_DWORD /d "1" /f

Mike, my guess would be that not everyone has switched over to the new standard. If they did away with flash right now, too much content would be unavailable. I think it is on it's way out though. It just may take more time.

This is rabbit's certificate, invalid. It can not be launched, luckily, I did not feel like to reinstall.

Bad Rabbit ransomware spread using leaked NSA EternalRomance exploit, researchers confirm | ZDNet

Bad Rabbit ransomware spread using the help of a leaked NSA exploit exposed by the Shadow Brokers hacking group, security researchers have confirmed.

Windows Defender Security Intelligence: Ransom:Win32/Tibbar.A threat description - Windows Defender Security Intelligence