Windows 10: Nasty ransomware overwrites your PC's master boot record

Thanks for the heads up folks .........I Just scored beta 6 there @ the link above after a Google search inquiry

No UEFI here.... I didn't want to fool around with all that GPT partitioning on the one PC here that can use it (the HP Elitebook ) the other three desktops are regular CMOS legacy Bios.

OTOH all this makes a good argument for UEFI mainboards . *really

 

Thanks for all that ..I've done the regedit and hidden file hunt before and some of the usual one time use cleaners for the big nasties (mostly on OP boxes ) outside of some toolbar hijackers and unwanted Crapafee shields from legitimate downloads [ like Flash @Adobe ] on my boxes before Chrome Pepperflash ....and so on if I didn't uncheck the right tix box . *really

.I never been stupid or unlucky enough to get all that hijacked so far . I copied and pasted all that into my Windows 10 tips folder that will be included in my regular back ups outside this OS of in case somebody can use it or I forget but I shouldn't it's good to know and fairly simple and routine outside the newbies .

FWIW (so far this works here ) ....when I see a ransomware looking or any dodgy redirect ....I kill the browser app & processes in Taskman ,relaunch the browser and go on about my business *really

 

right .........a good clean back up is a sure thing *really

 

Thanks.. for reassuring

I do use UEFI with the secure boot. I used UEFI originally because it handles the 2TB hard drive limit when using MBR. I do have a couple of 3 & 4 TB drives. Such a hassle getting them usable in an MBR system.

 

My laptop uses UEFI and Secure Boot is enabled by default. Does that mean that I don't need to worry about ransomware?

 

So if you enable UEFI without secure boot, you could still be protected and even use windows 7 64 bit and Linux 64 bit systems?

 

UEFI and secure boot will not protect you against ransomware. All they need to do is gain access to your system and encrypt your precious files. They don't need to encrypt the MBR.

Offline backups will protect you.

 

Thanks for the info.

 

@Geneo


The thread is about ransomware that overwrites you MBR but doesn't encrypt the files.

This nasty ransomware overwrites your PC's master boot record | PCWorld

 

Just a followup on this topic. Like the title says, the technique is not easy but better than last resort of paying ransom -
Experts crack Petya ransomware, enable hard drive decryption for free
The technique is not exactly straightforward, but it works.

Experts crack Petya ransomware, enable hard drive decryption for free | PCWorld

http://www.bleepingcomputer.com/news...ator-released/

 

I just got to thinking about this. If booted from a repair cd or windows installation cd, why wouldn't Bootrec.exe /fixboot Bootrec.exe /fixmbr and if needed bootrec /rebuildbcd work on this ransonware?

 

I can read, can you? *Rolleyes I was responding to "My laptop uses UEFI and Secure Boot is enabled by default. Does that mean that I don't need to worry about ransomware?" which clearly is about ransomware in general, and I was quite specific in my answer.

 

Hi there

Again I would recommend ALWAYS USE A CLEAN BACKUP to remove any infection no matter how trivial.

Even if you use "Cleansing" software you are still working with an infected computer -- so I wouldn't guarantee the integrity of the cleansing process no matter how good the authors of the software say it is.

I mean would you fly a Dodgy plane and then repair it while it's IN THE AIR. !!!!

You'd of course want to repair it on the ground and replace defective parts -- same with a PC - boot from a stand alone bootable recovery system and restore a clean image.

Easily done --don't get panicked by these Ransomware tales --even if you are misfortunate enough to get one of these it's easy to deal with.

Plenty of decent FREE software for taking images / backups so no excuse --always keep a few and ensure the BACKUP is of course clean (similarly you wouldn't replace a defective part on a plane with another defective part - I hope !!.

Cheers
jimbo

 

100% agree - image backups are the best protection. You can backup to an NAS drive but I recommend simply using an external usb hard drive as it can be removed and hence less risk of it getting infected.

 

Agree with you guys regarding backup's (albeit repairing a plane in mid-flight will be awesome tho') but does standard backup tools protect against MBR corruption/rootkits?
'Suppose repairing BCD with the install media would work - My understanding is that, that is what secure-boot was intended for...