How to remove Petna ransomware virus

Petna ransomware hides several secrets within

Petna virus is the alternative name of a recent malware outbreak also called as Petya/Notpetya/Expetr/PetrWrap. IT experts will remember June 27 as the day a global cyber chaos. Unfortunately, it is the second case in a two months row. Multiple corporations all around the world reported having been struck with Petya malware.

Right after the emergence, online media got flooded with reports that the latest version of the notorious threat assaulted the virtual community.

Thus, the malware was labeled as NotPetya. However, after a closer look, specialists came up with the idea that it IS actually Petya, but its source code is overwritten.^[1]

The latest version of so-called Pertya.a/Petna behaves similarly to previous versions, instead of simply breaking into a system and encrypting personal files, the malware modifies boot settings enabling to run malware instead of Windows OS.

With the assistance of its unique operating system, the threat encodes valuable documents as well. However, it does not have a tendency to append any file extension. Likewise, these features enable the virus to wreak global chaos.

Recent findings reveal that there is no point in paying the money, as one of the perpetrator's email domain has been shut down, which means that you will not get your files back even if you pay the ransom.^[2] Thus, make a rush to remove Petna ransomware. FortectIntego or MalwarebytesMalwarebytes might be of assistance in this task.

The virus turns out to be something else than ransomware

Right when some of the users thought that sufficient protection would be ensured to evade the same scenario after WannaCry attack, Petna manifested its power on the entire cyber world. The attack reverberated in numerous countries, including constant target Ukraine, the United Kingdom, the US, Australia, Russia, France^[3], Spain and many more others.

Unfortunately, the world has not learned its lesson as the malware fed on the same on same system vulnerabilities as WannaCry – EternalBlue and weak SMB protocols.

However, the recent analysis by Comae Technologies and Kaspersky Lab report disclosed an astonishing fact – the malware is not actually crypto-virus!

It may seem that the malware is actually a disk wiper, but experts note that the malware does not delete files, but in fact, does not assign specific ID to a particular victimized computer meaning that it is nearly impossible to recover the files without acquiring the decryption key.

Anton Ivanov, Kaspersky Lab researcher, suggests that the original motive behind they virus was not profit making but rather mere destruction^[4]. Interestingly, that this current version, Petna malware, seems to have been programmed by a different author than the original version. In any case, there is no point in transmitting the files but rather perform Petna removal.

Petna spreads via corrupted update system?

The malware seems to have assaulted the same way as WannaCry – through system vulnerabilities. However, further analysis linked that the main source of infection was the Ukrainian accounting software developer M.E Doc. Perpetrators hacked into it and corrupted update network.

Thus, any company which used this software and installed the updated got infected as well.^[5] The company denied such allegations even though the researchers claim to have log files as proofs.

Looking from a technical perspective, the malware function via smbpeyta_kernel.bin, perfc.dat, and similar system files. At the moment, the most viable Petna hijack prevention is to update your operating system with cyber security tools.

Eliminating the malware

Since it is futile paying the ransom and expect data retrieval, make Petna removal your top priority. Naturally, ordinary uninstall and removal methods might not work out from the first attempt. Since the malware modified your boot systems, you will not be able to simply access anti-virus tools. Thus, you may benefit from below indicated instructions.

Note that the malware will load before Windows OS, you will have to tap F8 or F2 right after the initial Windows sign appears to enter Advanced Boot settings. There, you should be able to choose Safe Mode or System Restore to remove Petna virus.