203

My computer got encrypted by the Petya ransomware. After a long search I could not find a solution other than using file recovery software.

This helps a bit, but I am wondering if there is a way to completely restore my disk. I am not going to pay.

11
  • 43
    To improve this question you might want to add some telltale signs that a ransomware infection is from this particular malware. Most users have no way to tell the name of the particular malware which hit them which means they won't find this question.
    – Philipp
    Apr 10, 2016 at 16:32
  • 3
    I don't think there is a real infection, they are just collecting reps, which is ok here on SU if it is a good question that has not been asked before.
    – Moab
    Apr 10, 2016 at 18:20
  • 30
    Looks like it's not a rep grab but publicity for the exploit, which is by the OP himself. I wouldn't begrudge it, it looks non-trivial and potentially useful :-)
    – alexis
    Apr 10, 2016 at 20:25
  • 14
    I know it's not terribly relevant, but would you mind sharing how it happened? Perhaps it might help other users avoid this problem.
    – Nobilis
    Apr 11, 2016 at 7:21
  • 4
    Can I have a picture of the message
    – Suici Doga
    Apr 11, 2016 at 13:38

1 Answer 1

312

Fortunately, yes, there is a solution - I've written an application that would help with this.

Petya encryption has been reversed, analyzed and there is a solution to get the decryption key, just from the data on the encrypted disk.

The program code for key recovery is hosted on github: https://github.com/leo-stone/hack-petya.

If you can't or don't want to compile the program yourself,
there is an online service available:
https://petya-pay-no-ransom.herokuapp.com/
https://petya-pay-no-ransom-mirror1.herokuapp.com/ (if the first link is erroring for you)

You will still need to have a little computer experience though, to get the necessary data off your disk.

Update: Service has been taken down, it wasn't used anymore.

16
  • 78
    This is why you should never write your own encryption.. though I suppose in this case it's fortunate that they did. If they had used AES, there'd be no way to brute-force the key like this. Apr 10, 2016 at 19:43
  • 9
    @vsz The authors of this malware encrypt the hard-drive at a hardware level, and wrote their own bootloader (!?!). I'm sure they've heard of AES. It's like as oakad says, they probably did this intentionally for maximum speed. Apr 11, 2016 at 5:12
  • 34
    Oh, the disclosure rule. I do strongly recommend you do so, if only cause I'm getting a ton of spam flags for a useful tool ;)
    – Journeyman Geek
    Apr 11, 2016 at 12:04
  • 14
    Could you add a basic explanation of what your code does? The answer is complete; I'm just curious and my school WiFi doesn't let me load GitHub repos that don't belong to me.
    – Nic
    Apr 11, 2016 at 13:14
  • 5
    @QPayTaxes The author goes about it in an intentionally roundabout way -- You can plug the decryption routine into just about any constraint solver and have an answer in seconds ( pastebin.com/Zc16DfL1 )
    – zetavolt
    Apr 12, 2016 at 8:07

Not the answer you're looking for? Browse other questions tagged or ask your own question.