Author Topic: Petya-based ransomware is spreading and infecting computers around the world  (Read 2611 times)

0 Members and 1 Guest are viewing this topic.

Offline Jeff.S

  • Avast team
  • Jr. Member
  • *
  • Posts: 84
Further to reports of a massive cyber attack hitting a number of companies in Ukraine, including banks, energy companies and transport services as well as the government. Avast believes this is another example of the Petya-based ransomware, which was first identified in 2016. A few months ago, Petya ransomware was spotted patched and bundled as a different malware strain called PetrWrap. The attack appears to be spreading with incidents being reported in Russia, India, France, Spain and also the Netherlands. Malware writers behind the attack, are demanding a $300 ransom to be paid in the Bitcoin cryptocurrency.
Please read the full article here:
      https://blog.avast.com/petya-based-ransomware-using-eternalblue-to-infect-computers-around-the-world
      https://www.avast.com/c-petya
Customers using the latest versions of Avast, are protected against the Petya-based ransomware.  If your PC is infected with Petya, our antivirus will detect it, quarantine it and destroy it. If it detects Petya is trying to enter your computer, it will block it from getting in. We will provide regular updates to protect against possible future variants. If you are concerned, please ensure your antivirus software is up-to-date. Finally, we strongly recommend that all Windows users, update their systems with any available patches as soon as possible.
Other articles of reference:
      Techworld - http://www.techworld.com/security/best-ransomware-removal-tools-how-clean-up-cryptolocker-cryptowall-extortion-malware-3626974/ (AVG decryption tools and Avast product)
      CIO -  http://www.cio.co.uk/it-security/what-are-best-anti-ransomware-tools-protect-your-organisation-3659192/ (AVG product and decryption tools)
      CNET -  https://www.cnet.com/uk/news/unprecedented-cyberattack-hits-businesses-across-europe/ (Avast product, Threat Labs comment)
      Fintech -  http://www.fintech.finance/01-news/petya-attack-avast-labs-data-comment/ (full Avast blog)
      Forbes - https://www.forbes.com/sites/thomasbrewster/2017/06/27/petya-notpetya-ransomware-is-more-powerful-than-wannacry/#55ef2a8d532e

We currently detect all known variants of Petya/PetrWrap ransomware.  However, Petya/PetrWrap is actively updated frequently to avoid detection by antivirus security protection. 
Best Practices (How To Stay Safe)
      Regularly backup all important data off-site
      Disable Microsoft Office macros
      Educate end users not to open unknown files from email attachments or the Internet
      Verify all server and workstation operating systems are fully patched and updated
      Verify all Avast/AVG clients are fully updated to the latest versions, and virus database definitions below...
Virus Database Definitions
      Avast: 170628-0 or newer
      AVG: 4779/14620 or newer

« Last Edit: June 28, 2017, 10:12:31 PM by Jeff.S »

Offline Eddy

  • Avast Evangelist
  • Maybe Bot
  • ***
  • Posts: 31079
  • Watching (over?) you
    • Malware removal, Biljart and other things.
As addition, I would say not only backup the data but create a image of the entire system every day and store it not just at home but also somewhere else.
« Last Edit: June 29, 2017, 12:05:23 PM by Eddy »

REDACTED

  • Guest
Customers using the latest versions of Avast, are protected against the Petya-based ransomware. 

This statement bothers me.  I know I'm being pedantic and am going to rant a little, but I'm not running the latest version of Avast, I am still on 12.3.2515. 

It's because 17.x branch breaks my System State backups.  A showstopper for my server.  In addition, I've read countless problems with GUI, exclusions, Vault, VM hassles, etc and so I've chosen not to upgrade my site until I feel satisfied the quirks are ironed out, or at least until System State backups are fixed. 

Does this mean I am not protected from Petya?  I'd say unlikely, but the statement does make me feel uneasy.  I don't think I've ever seen a product lifecycle statement that says what versions are and are notsupported, and therefore should be providing Petya protection.  Anyone able to link me to this? 

I feel customers should be able to choose what version they want to run within the bounds of product support.  Latest is not always best for everyone.  If there are any supported Avast versions that don't protect against Petya, we should be told so we can assess the risks ourselves, not just be told "always use the latest".


Offline Eddy

  • Avast Evangelist
  • Maybe Bot
  • ***
  • Posts: 31079
  • Watching (over?) you
    • Malware removal, Biljart and other things.
Let me "rant" a bit also.

Quote
In addition, I've read countless problems with GUI, exclusions, Vault, VM hassles, etc
You are forgetting a very important thing.
People who have problems will post here, people who have no problems are almost never post here.
That makes it only seems that a lot of people have problems.
If everyone who does not have a problem would post here it would become really hard to find a post from someone who actually has a problem.

Next to that, a quiet large amount of people who claim they have a problem is "pebkac".
They never bothered to e.g. check/read the FAQ.
Just three examples :
They complain about Chrome being installed without their permission.
When you run the installer there is a check mark is in front of "also install Chrome" and they just click on "next" without reading what is on their screen.

They complain that they are automatically charged without their permission.
When ordering the subscription they have chosen for automatic renewal (aka continues protection).

The GUI problems.
People (who are using Windows XP) have the terminal service disabled while it is enabled by default on Windows XP.
And they complain that the GUI isn't working.
Yeah right, that is like removing all the fuel from a car and then start complaining that it wouldn't start.

Quote
A showstopper for my server.
If you are running a server, you should run a server av not a consumer one.

If the statement about Petya is bothering you, you clearly don't understand it.
It means that avast (and all other decent av's for that matter) will detect all known variants of it.
Actually it is not needed for a av to detect them.
You only can get infected if you don't have installed the security update from MS that prevents a system from getting infected.
All systems that are infected with the latest variant of Petya are not up-to-date.

Not using the latest av is like getting a car that only is able to drive in a straight line, not being able to make corners.
Running such a old version is saying "He, I don't care about security"
Don't be surprised if you start driving and hit a tree.
Quote
I feel customers should be able to choose what version they want to run within the bounds of product support.
This may come as shock to you but they can.
But keep in mind that the most common error when it comes to computers is PEBKAC.

Quote
If there are any supported Avast versions that don't protect against Petya, we should be told
There is something called common sense.
If avast is saying something like "our latest version (VPS) will protect you against it", it is only logical that previous versions don't.
People should use their brains!