Modern PC’s don’t use the MBR to start Windows, and since the introduction of Windows 8, just about every PC uses Microsoft ‘Secure Boot’ which checks the digital signature of the boot code at startup. This might sound like overkill, but the Petya attack injected its payload into the legacy Master Boot Record (MBR) boot code. If your Windows installation was patched up to date then the virus couldn’t spread to you via another networked PC. The latest attack exploited a vulnerability in the Windows Server Message Block (SMB) protocol that had been previously patched on every version of Windows, including XP. So, what can we do to reduce the risk of attack and protect our data if the worst should happen? Keep Windows up to date with the latest patches Even though ransomware attacks tend to be focused on large organizations and businesses, the contagion quickly spreads to vulnerable systems throughout the world. If you’re an individual PC user then don’t be lulled into thinking that these attacks won’t affect you. While the ransomware was encrypting data, Tuesday’s attack showed a fake but credible Windows check disk screen before displaying the ransom demand. Petya ransomware updates the Windows Master Boot Record (MBR) boot code with its payload and, while encrypting the NTFS file system at Windows boot time, presents a ransom message on the PC that’s now failing to start. This latest attack is part of the ‘Petya’ family of encrypting ransomware. Clearly ransomware is proving very lucrative for the criminals behind it and the potential economic damage caused by data loss makes state sponsored ransomware attacks inevitable. The total loss of money and data may never be known but this type of attack is becoming increasingly popular. This has left millions of data files lost forever. This was the largest worldwide attack since the ‘WannaCry’ virus last month.Ī Bitcoin payment, equivalent to $300, was demanded to recover encrypted data and it’s believed that this ransom was extorted from only a few of those infected until the payment system was stopped. A new ransomware virus attack hit on Tuesday 27th June with its epicentre in Ukraine and quickly spread around the world.

Is macrium reflect safe