News for hackers. Stuff that matters.

A comment on Reversing the Petya ransomware with constraint solvers. Parent comment

Re:Reversing the Petya ransomware with constraint solvers by rzzzt on Saturday April 23, 2016 @02:39PM (#11556775)
In the Windows XP era, there was SteadyState: https://en.wikipedia.org/wiki/Windows_SteadyState
[ Parent | on HN ]
Re:Reversing the Petya ransomware with constraint solvers by musesum on Saturday April 23, 2016 @03:06PM (#11556949)
Aha, looks like SteadyState accomplishes the same thing. Very cool! I wonder how a Windows Restore Point is defeated? Because it is in the same partition?
[ Parent | on HN ]
Re:Reversing the Petya ransomware with constraint solvers by rzzzt on Saturday April 23, 2016 @03:44PM (#11557103)
Malware can disable System Restore and delete existing restore points if the user account they are running under has the rights to do so. I think the Cryptolocker variants did this, but not sure...
[ Parent | on HN ]