How to Remove Petya Ransomware and Recover Data
Petya is a new and powerful ransomware that targets and encrypts the Master Boot Record (MBR)of the compromised computer, replacing it with a malicious loader (MBR contains information that loads the Operating System on a computer which can’t load with OS). The malware forces Windows to reboot and demands 0.9 Bitcoin in return for the decryption key (about $390 USD in April 2016).
Petya is distributed through emails that are written in a very polite manner and with proper grammar. The email, presented as coming from an applicant for a job position, contains a Dropbox link, supposedly, leading to a CV or some other important document too big to be sent as an attachment. If a user opens it, the virus captures the computers. Instead of loading an Operating System, a message loads requesting the ransom, accompanied by an image of a skull generated on ASCII. Then instructions are loaded on the screen about how users should use the Tor network to pay the ransom.
Petya claims to use a military encryption algorithm, but the origin of the ransomware is unknown, although the name Petya is a common name in Russia, Bulgaria and a few other countries with Slavic population. On the other hand, Petya and the wolf (Op. 67), is a well-known composition written by Soviet composer Sergei Prokofiev in 1936 in the USSR. It is a children’s story, spoken by a narrator accompanied by the orchestra.
No doubt that the Petya ransomware can also be distributed via social networks or file sharing services, asking users to open the link.
Here is how the message reads: You became victim of the Petya Ransomware. The hard disks of your computer have been encrypted with a military grade encryption algorithm. There is no way to restore your data without a special key. You can purchase this key on the dark net page shown in step 2. To purchase your key and restore your data, please follow these three easy steps:
1. Download the Tor Browser at (URS address). If you need help, please google for “access onion page”.
2. Visit one of the following pages with the Tor Browser: (URL addresses)
3. Enter your personal decryption code there: (random code)
If you already purchased your key, please enter it below.
In fact, contacting the ransomware creators will not help. Nobody can guarantee that you will have your data and drives unlocked and restored. Paying ransomware makers endorses them to create new ransomwares and anyway you may not get your computer back
Unfortunately, no known ways exist to repair the Master Boot Record at this moment. Thus the damage can be irreparable and your disk drive may remain locked forever.
- Apple Encyclopedia: all information about company, products, electronic devices, operating systems and apps.
- iGotOffer.com: the best place to sell my used Apple device online for the top price. Free quote, free shipping. BBB A+ rated business.
Credit photo: Photograph in public domain