How to remove NotPetya ransomware virus

The massive NotPetya attack cost millions of dollars for corporations

NotPetya is a ransomware virus that attacked thousands of computers with the help of Windows OS vulnerability. The malware caused problems not only for home computer users but corporations and infrastructure. Due to the malware attack, flights were delayed, and petrol stations ceased functioning properly. Two months after a ransomware attack, companies are still counting the financial loss, and the sums of money reach 200-300 million dollars per company.

The worldwide attack hit the US, the UK^[1], Spain, and, certainly, Ukraine^[2] the hardest. However, the virus targeted Chernobyl's radiation monitoring system as employees had to take control of radiation levels manually.^[3] So far, the virus:

• corrupts MBR settings, individual malware samples encrypt files
• demands 300 USD ransom
• exploits Windows OS vulnerabilities
• delivers wowsmith123456@posteo.net for contact purposes
• disguises as Petya, but functions as independent malware
• targets the US, Europe and particularly Ukraine

The threat meddles with the boot settings preventing systems from starting normally. At this stage, the threat does not seem to append any extension to the files as it does not encrypt them, but in fact, causes system failure. According to the ransom message, the threat demands $300 and indicates them to transfer to wowsmith123456@posteo.net.

Fortunately, IT expert Lawrence Abrams found an antidote to prevent the attack of the malware.^[3] Not only companies globally have been struck but individuals as well. If you happen to be one of them, make sure you remove NotPetya with the assistance of an anti-spyware tool, such as FortectIntego or MalwarebytesMalwarebytes.

NotPetya attack might cost 200-300 million for A.P. Moller-Maersk

Danish shipping company A.P. Moller-Maersk was one of the victims of the massive ransomware attack on June 28th. Ransomware hit Maersk Line, APM Terminals, and Damco that belongs to the shipping giant.

According to the company’s financial statement,^[4] the attack caused a “significant business interruption” that had a negative financial impact. After the attack, computer systems were shut down in order to stop malware from spreading.

Within few days, the work came back to normal. However, the company fully recovered after the ransomware infiltration only on July 9. Fortunately, A.P. Moller-Maersk did not lose any documents and hadn't suffered from the data breach.

However, the ransomware attack was an expensive lesson for the shipping company. This cyberattack proves that corporations have to pay more attention to cybersecurity and improve their current security systems to avoid financial loss.

Similarities to Petya and WannaCry viruses

The malware starts with the same remark as the notorious WannaCry threat:

Ooops, your important files are encrypted.
If you see this text, then your files are no longer accessible, because they have been encrypted. Perhaps you are busy looking for a way to recover your
files, but don’t waste your time. Nobody can recover your files without our
decryption service.
We guarantee that you can recover all your files safely and easily. All you
need to do is submit the payment and purchase the decryption key.
Please follow the instructions:
1. Send $300 worth of Bitcoin to the following address:
lflz7153HHuxXTuR2R1t78mGSdzafithBUX
2. Send your Bitcoin wallet ID and personal installation key to e-mail
wowsmith123456@posteo.net. 
If you already purchased your key, please enter it below.

Though initially, the virtual community thought the malware is Petya as it also targeted Master Boot Record settings interfering with boot processes, now IT professionals claim that the infection disguises under the title of the previous title, actually, is a different malware.^[5] At the moment, the virus bears the name of NotPetya.

It seems that the perpetrators have learned from WannaCry developers' mistakes. The malware also feeds on Windows vulnerabilities. 

Despite the warnings from cyber security forces, the malware has managed to wreak havoc. International facilities such as airport did not update their systems which resulted in severe outcomes.

Interestingly, the first outbreak of the threat was spotted in Ukraine. It seems that the latter country has become a “test subject” for hackers. The former virus, WannaCry manifested its power there first. Right after the attack, XData virus struck Ukraine again.

The success of the attack hides behind NSA hacking tools

Cybercriminals have benefitted from previously leaked NSA hacking tools. The attack is likely to occur if your operating system has been outdated. Mostly, Windows 7 versions have suffered the attack.

Fortunately, an “antidote” has been found – you have to create a text file titled perfc in your C:Windows folder.^[6] It is likely that the malware might employ other distribution methods: spam emails and exploit kits. To remediate the flaws, users are urged to update their operating systems to the latest version.

Ransomware elimination process

Despite the type of ransomware you are dealing with, its elimination should become your top priority. Thus, make a rush to remove the virus. Fortunately, the malware is detected by almost all major anti-virus tools. For the elimination, we recommend SpyHunterCombo Cleaner or MalwarebytesMalwarebytes. Also, FortectIntego is a useful tool that could help you fix any Windows damage caused by ransomware.

Since the virus corrupts the boot process, you may not be able to access your cybersecurity software, in that case, the below instructions will be in handy. In case you have been struck with the version which encrypts files, decrypt data with an alternative program until a decrypter is released.