Tuesday, June 27, 2017

#Petya encrypts ON BOOT. If you see CHKDSK message your files not yet encrypted, power off immediately. You can recover with with LiveCD.

  1. We have found local “kill switch” for : create file "C:\Windows\perfc"
  2. encrypts ON BOOT. If you see CHKDSK message your files not yet encrypted, power off immediately. You can recover with with LiveCD.