205

My computer got encrypted by the Petya ransomware. After a long search I could not find a solution other than using file recovery software.

This helps a bit, but I am wondering if there is a way to completely restore my disk. I am not going to pay.

  • 43
    To improve this question you might want to add some telltale signs that a ransomware infection is from this particular malware. Most users have no way to tell the name of the particular malware which hit them which means they won't find this question. – Philipp Apr 10 '16 at 16:32
  • 3
    I don't think there is a real infection, they are just collecting reps, which is ok here on SU if it is a good question that has not been asked before. – Moab Apr 10 '16 at 18:20
  • 30
    Looks like it's not a rep grab but publicity for the exploit, which is by the OP himself. I wouldn't begrudge it, it looks non-trivial and potentially useful :-) – alexis Apr 10 '16 at 20:25
  • 14
    I know it's not terribly relevant, but would you mind sharing how it happened? Perhaps it might help other users avoid this problem. – Nobilis Apr 11 '16 at 7:21
  • 4
    Can I have a picture of the message – Suici Doga Apr 11 '16 at 13:38
313

Fortunately, yes, there is a solution - I've written an application that would help with this.

Petya encryption has been reversed, analyzed and there is a solution to get the decryption key, just from the data on the encrypted disk.

The program code for key recovery is hosted on github: https://github.com/leo-stone/hack-petya.

If you can't or don't want to compile the program yourself,
there is an online service available:
https://petya-pay-no-ransom.herokuapp.com/
https://petya-pay-no-ransom-mirror1.herokuapp.com/ (if the first link is erroring for you)

You will still need to have a little computer experience though, to get the necessary data off your disk.

Update: Service has been taken down, it wasn't used anymore.

  • 78
    This is why you should never write your own encryption.. though I suppose in this case it's fortunate that they did. If they had used AES, there'd be no way to brute-force the key like this. – BlueRaja - Danny Pflughoeft Apr 10 '16 at 19:43
  • 9
    @vsz The authors of this malware encrypt the hard-drive at a hardware level, and wrote their own bootloader (!?!). I'm sure they've heard of AES. It's like as oakad says, they probably did this intentionally for maximum speed. – BlueRaja - Danny Pflughoeft Apr 11 '16 at 5:12
  • 34
    Oh, the disclosure rule. I do strongly recommend you do so, if only cause I'm getting a ton of spam flags for a useful tool ;) – Journeyman Geek Apr 11 '16 at 12:04
  • 14
    Could you add a basic explanation of what your code does? The answer is complete; I'm just curious and my school WiFi doesn't let me load GitHub repos that don't belong to me. – Nic Hartley Apr 11 '16 at 13:14
  • 5
    @QPayTaxes The author goes about it in an intentionally roundabout way -- You can plug the decryption routine into just about any constraint solver and have an answer in seconds ( pastebin.com/Zc16DfL1 ) – ŹV - Apr 12 '16 at 8:07

protected by Raystafarian Apr 13 '16 at 13:50

Thank you for your interest in this question. Because it has attracted low-quality or spam answers that had to be removed, posting an answer now requires 10 reputation on this site (the association bonus does not count).

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.