Vaccine for NotPetya/Petna/Petya (batch file/instructions)

[LASER_oneXM]

hi

simply take a look at the article. You can find there a batch file or if you want you can follow the instructions in the article to vaccine your PC:

How to Enable the NotPetya/Petna/Petya Vaccine

To vaccinate your computer so that you are unable to get infected with the current strain of NotPetya/Petya/Petna (yeah, this naming is annoying), simply create a file called perfc in the C:\Windows folder and make it read only. For those who want a quick and easy way to perform this task, Lawrence Abrams has created a batch file that performs this step for you.

This batch file can be found at: https://download.bleepingcomputer.com/bats/nopetyavac.bat

For those who wish to vaccinate their computer manually, you can so using the following steps. Please note that these steps are being created to make it as easy as possible for those with little computer experience. For those who have greater experience, you can do it in quite a few, and probably better, ways.

 

[Parsh]

That's a nice cheat there, to prevent NotPetya from creating or modifying that "perfc.dat" file in the concerned directory.
This method evolves from the point discovered earlier about its working:

So, restriction on PSExec utility from Sysinternals suite is beneficial.
The spreading of attack via exploiting PSExec appears to harm even the patched machines ofcourse, since this is another vector of spreading, different than the primary means of Wannacry infection. EternalBlue modifications are anyways used.

 

[Korea]

There is a variant of malware that can not be blocked.

 

[RECdevicehelper]

hi

simply take a look at the article. You can find there a batch file or if you want you can follow the instructions in the article to vaccine your PC:

Great Job, this is really helpful information
Time to stop these cyber scums

 

[donQxte]

If you're needing to get it onto a lot of machines, PDQ Deploy may help:
Vaccinating All Your Network Machines Against NotPetya - PDQ.com

 

[RECdevicehelper]

If you're needing to get it onto a lot of machines, PDQ Deploy may help:
Vaccinating All Your Network Machines Against NotPetya - PDQ.com

Thank you, that is very useful

 

[Korea]

MRG – EternalRomance vs Internet Security Suites and nextgen protections
Other Information

 

[soccer97]

MRG – EternalRomance vs Internet Security Suites and nextgen protections
Other Information

Thank you - the MRG article was very helpful. It also displays in particular which vendors block the exploit and what to look for when an alert appears.