Malware · critical

How to fix Petya / NotPetya Ransomware-Wiper

Error code: PETYA_NOTPETYA_WIPER

What this error means

Petya/NotPetya is a highly destructive wiper malware masquerading as ransomware. It targets Windows computers, encrypting the Master File Table (MFT) and overwriting the Master Boot Record (MBR) to completely prevent the operating system from booting.

Updated

Before you begin

Save open work and back up important files. Use instructions for your exact device and software version. If Windows cannot start, see the startup guide.

Work through these checks

0 of 4 complete
01Install MS17-010 patch and keep system updated
  1. Install MS17-010 patch and keep system updated
What to expect

Check whether the original symptom still occurs.

If it does not help

Continue only if this check applies to your device. Consult its manufacturer if you are unsure.

Browse related errors
02Disable SMBv1 and limit administrative share access
  1. Disable SMBv1 and limit administrative share access
What to expect

Check whether the original symptom still occurs.

If it does not help

Continue only if this check applies to your device. Consult its manufacturer if you are unsure.

Browse related errors
03Use boot sector write protections in BIOS/UEFI
  1. Use boot sector write protections in BIOS/UEFI
What to expect

Check whether the original symptom still occurs.

If it does not help

Continue only if this check applies to your device. Consult its manufacturer if you are unsure.

Browse related errors
04Perform clean OS installation if MBR/MFT is completely destroyed
  1. Perform clean OS installation if MBR/MFT is completely destroyed
What to expect

Check whether the original symptom still occurs.

If it does not help

Continue only if this check applies to your device. Consult its manufacturer if you are unsure.

Browse related errors

Possible causes

  • SMB vulnerabilities (EternalBlue/EternalRomance) on unpatched machines
  • Compromised administrative credentials harvested via Mimikatz-like methods
  • Malicious updates in accounting software supply chains