205

My computer got encrypted by the Petya ransomware. After a long search I could not find a solution other than using file recovery software.

This helps a bit, but I am wondering if there is a way to completely restore my disk. I am not going to pay.

  • 43
    To improve this question you might want to add some telltale signs that a ransomware infection is from this particular malware. Most users have no way to tell the name of the particular malware which hit them which means they won't find this question. – Philipp Apr 10 '16 at 16:32
  • 3
    I don't think there is a real infection, they are just collecting reps, which is ok here on SU if it is a good question that has not been asked before. – Moab Apr 10 '16 at 18:20
  • 30
    Looks like it's not a rep grab but publicity for the exploit, which is by the OP himself. I wouldn't begrudge it, it looks non-trivial and potentially useful :-) – alexis Apr 10 '16 at 20:25
  • 14
    I know it's not terribly relevant, but would you mind sharing how it happened? Perhaps it might help other users avoid this problem. – Nobilis Apr 11 '16 at 7:21
  • 4
    Can I have a picture of the message – Suici Doga Apr 11 '16 at 13:38
313

Fortunately, yes, there is a solution - I've written an application that would help with this.

Petya encryption has been reversed, analyzed and there is a solution to get the decryption key, just from the data on the encrypted disk.

The program code for key recovery is hosted on github: https://github.com/leo-stone/hack-petya.

If you can't or don't want to compile the program yourself,
there is an online service available:
https://petya-pay-no-ransom.herokuapp.com/
https://petya-pay-no-ransom-mirror1.herokuapp.com/ (if the first link is erroring for you)

You will still need to have a little computer experience though, to get the necessary data off your disk.

Update: Service has been taken down, it wasn't used anymore.

  • 78
    This is why you should never write your own encryption.. though I suppose in this case it's fortunate that they did. If they had used AES, there'd be no way to brute-force the key like this. – BlueRaja - Danny Pflughoeft Apr 10 '16 at 19:43
  • 9
    @vsz The authors of this malware encrypt the hard-drive at a hardware level, and wrote their own bootloader (!?!). I'm sure they've heard of AES. It's like as oakad says, they probably did this intentionally for maximum speed. – BlueRaja - Danny Pflughoeft Apr 11 '16 at 5:12
  • 34
    Oh, the disclosure rule. I do strongly recommend you do so, if only cause I'm getting a ton of spam flags for a useful tool ;) – Journeyman Geek Apr 11 '16 at 12:04
  • 14
    Could you add a basic explanation of what your code does? The answer is complete; I'm just curious and my school WiFi doesn't let me load GitHub repos that don't belong to me. – Fund Monica's Lawsuit Apr 11 '16 at 13:14
  • 5
    @QPayTaxes The author goes about it in an intentionally roundabout way -- You can plug the decryption routine into just about any constraint solver and have an answer in seconds ( pastebin.com/Zc16DfL1 ) – ŹV - Apr 12 '16 at 8:07

Not the answer you're looking for? Browse other questions tagged or ask your own question.