Petya/Notpetya ransomware: we have a vaccine!

Just create a file in c:\windows!

Currently we have a lot of information about Petya (ot Notpetya): you can take a look at this post, that i use to collect all information gathered from websites and social networks.

And from twitter, i have gained this priceless information about a ‘local vaccine’ for the ransomware, likewise to the famous Wannacry’s killswitch.

Amit Serper found that the malware not ‘detonate’ on system if a specific file was found on the c:windows folder.

After some minutes, Amit confirm the discovery:

https://twitter.com/0xAmit/status/879778335286452224

Also other researchers confirms that the trick is working

and Chris Campbell‏ releases a powershell script that automate the creation of the file and apply read-only ACL:

Comments