home - Safety
How to recover data after an attack by the Petya virus (step-by-step instructions)

A few days ago, an article appeared on our resource about how to protect yourself from the virus and its varieties. In the same instructions, we will look at the worst case scenario - your PC is infected. Naturally, after recovery, each user tries to restore their data and personal information. This article will discuss the most convenient and effective methods for data recovery. It is worth considering that this is not always possible, so we will not give any guarantee.

We will consider three main scenarios in which events can develop:
1. The computer is infected with the Petya.A virus (or its variants) and is encrypted, the system is completely blocked. To restore data, you need to enter a special key, for which you need to pay. It’s worth saying right away that even if you pay, this will not remove the blocking and will not give you back access to your personal computer.

2. An option that provides the user with more options for further actions - your computer is infected and the virus began to encrypt your data, but the encryption was stopped (for example, by turning off the power).

3. The last option is the most favorable. Your computer is infected, but file system encryption has not yet begun.

If you have situation number 1, that is, all your data is encrypted, then at this stage there is no effective way to restore user information. It is likely that this method will appear in a few days or weeks, but for now experts and everyone in the field of information and computer security are scratching their heads over it.

If the encryption process has not started or is not completely completed, then the user should interrupt it immediately (encryption is displayed as a Check Disk system process). If you managed to boot the operating system, then you should immediately install any modern antivirus (all of them currently recognize Petya and do a full scan of all disks. If Windows does not boot, then the owner of the infected machine will have to use the system disk or flash drive to restore the MBR boot sector .

Restoring the bootloader on Windows XP

After loading the system disk with the Windows XP operating system, you will be presented with options for action. In the "Install Windows XP Professional" window, select "To restore Windows XP using the Recovery Console, press R." Which is logical, you will need to press R on the keyboard. A console for restoring the partition and a message should appear in front of you:

""1:C:\WINDOWS Which copy of Windows should I sign in to?""


If you have one version of Windows XP installed, then enter “1” from the keyboard and press enter. If you have several systems, then you need to select the one you need. You will see a message asking for the administrator password. If there is no password, then simply press Enter, leaving the field empty. After this, a line will appear on the screen, enter the word " fixmbr"

The following message should appear: “WARNING! Do you confirm the entry of the new MBR?”, press the “Y” key on the keyboard.
The response will appear: “A new primary boot sector is being created on the physical disk...”
"The new primary boot partition was created successfully."

Restoring the bootloader on Windows Vista

Insert a disk or flash drive with the Windows Vista operating system. Next, you need to select the line “Restore your computer.” Select which Windows Vista operating system (if you have more than one) to restore. When the recovery options window appears, click on Command Prompt. At the command prompt, enter the command " bootrec/FixMbr".

Restoring the bootloader on Windows 7

Insert a disk or flash drive with the Windows 7 operating system. Select which Windows 7 operating system (if you have several of them) you want to restore. Select "Use recovery tools that can help solve problems starting Windows." Next, select “Command Line”. After loading the command line, enter " bootrec/fixmbr

Restoring the bootloader on Windows 8

Insert a disk or flash drive with the Windows 8 operating system. On the main screen, select "Repair your computer" in the lower left corner. Select Troubleshooting. Select the command line, when it loads, enter: "bootrec/FixMbr" If everything goes well, you will see a corresponding message and all that remains is to restart the computer.

Restoring the bootloader on Windows 10

Insert a disk or flash drive with the Windows 10 operating system. On the main screen, select "Repair your computer" in the lower left corner. Select Troubleshooting. Select the command line, when it loads, enter: "bootrec/FixMbr" If everything goes well, you will see a corresponding message and all that remains is to restart the computer.



 


Read:



Putting things in order - cleaning the hard drive in Windows 10

Putting things in order - cleaning the hard drive in Windows 10

If you work a lot and intensively on your computer, you can quickly fill up your hard drive partitions with documents and files. For solid state...

Wanna Cry “shouted” to the whole world - how to solve the virus problem

Wanna Cry “shouted” to the whole world - how to solve the virus problem

Yes, this virus shouted very loudly to the whole world on May 12th. Wanna Cry turned out to be not a virus that quietly and calmly spreads throughout the world...

Temporary mail for 10 minutes without registration

Temporary mail for 10 minutes without registration

I think you have already encountered such a situation when you needed to register on some site, for example, in, and for this...

What to do and how to unlock?

What to do and how to unlock?

Many users of the Odnoklassniki social network complain that they cannot get to their page - supposedly it is blocked. But why? How...

feed-image RSS