App Review Petya MBR Encryption Ransomware Test

[cruelsister]

Of course the best solution is to use CF in the first place.

Just saying...

 

[Dirk41]

Hi everyone, may i ask you if SBIE could handle Petya? Thank you

 

[cruelsister]

Yes it does, and quite easily. Personally SBIE would be my second choice after CF for overall protection against any malware.

 

[Dirk41]

Ehm sorry I am not an expert, tried to google cf but I can't find anything that explain what is it for and what is it

 

[harlan4096]

I guess They are talking about Comodo FireWall

 

[cruelsister]

Sorry Dirk! As Harlan said I meant Comodo Firewall.

 

[Dirk41]

May I ask a question? I didn't get what exactly happens before the reboot.
If the encryption starts after the reboot, would be enough to prevent the reboot and delete the ransomware? I don't know about Petya, but, for example, tesla 3.0 wasn't much difficult to remove, the difficult part is to decrypt.

Thank you

 

[Dirk41]

May I ask a question? I didn't get what exactly happens before the reboot.
If the encryption starts after the reboot, would be enough to prevent the reboot and delete the ransomware? I don't know about Petya, but, for example, tesla 3.0 wasn't much difficult to remove, the difficult part is to decrypt.

Thank you

OK got it: from bleepig computer:

When first installed, the Petya Ransomware will replace the boot drive's existing Master Boot Record, or MBR, with a malicious loader. The MBR is information placed at the very beginning on a hard drive that tells the computer how it should boot the operating system.

 

[cruelsister]

Dirk- When Petya is run it will establish priority loading for itself then reboot the computer. On reboot that Checkdisk routine you see running is fraudulent, giving time for the malware to corrupt (encrypt) the Master file Table (so it seems to things that the hard drive does not exist).

It is curious that on some German Forums people have been using Recovery console and getting to a command prompt where they are using bootrec with the usual switches (/rebuildBCD, /fixmbr, and /fixboot) and saying that the system was recovered. Now this routine presupposes that Recovery Console can actually see the corrupt Windows installation which it cannot on every sample that I've come across, so I find these claims curious.