Companies have been crippled by global cyberattack, the second major ransomware crime in two months. We answer the key questions 
 
 Many organizations in Europe and the US have been crippled by a ransomware attack known as “Petya”. The malicious software has spread through large firms including the advertiser WPP, food company Mondelez, legal firm DLA Piper and Danish shipping and transport firm Maersk, leading to PCs and data being locked up and held for ransom. 
 
 
 
 It’s the second major global ransomware attack in the past two months. In early May, Britain’s National Health Service (NHS) was among the organizations infected by WannaCry, which used a vulnerability first revealed to the public as part of a leaked stash of NSA-related documents released online in April by a hacker group calling itself the Shadow Brokers. 
 
 NotPetya ransomware attack 'not designed to make money' Read more 
 
 The WannaCry or WannaCrypt ransomware attack affected more than 230,000 computers in over 150 countries, with the NHS, Spanish phone company Telefónica and German state railways among those hardest hit. 
 
 Like WannaCry, “Petya” spreads rapidly through networks that use Microsoft Windows, but what is it, why is it happening and how can it be stopped? 
 
 What is ransomware? 
 
 Ransomware is a type of malware that blocks access to a computer or its data and demands money to release it. 
 
 How does it work? 
 
 When a computer is infected, the ransomware encrypts important documents and files and then demands a ransom, typically in Bitcoin, for a digital key needed to unlock the files. If victims don’t have a recent back-up of the files they must either pay the ransom or face losing all of their files. 
 
 How does the “Petya” ransomware work? 
 
 The ransomware takes over computers and demands $300, paid in Bitcoin. The malicious software spreads rapidly across an organization once a computer is infected using the EternalBlue vulnerability in Microsoft Windows (Microsoft has released a patch, but not everyone will have installed it) or through two Windows administrative tools. The malware tries one option and if it doesn’t work, it tries the next one. “It has a better mechanism for spreading itself than WannaCry,” said Ryan Kalember, of cybersecurity company Proofpoint. 
 
 Is there any protection? 
 
 Most major antivirus companies now claim that their software has updated to actively detect and protect against “Petya” infections: Symantec products using definitions version 20170627.009 should, for instance, and Kaspersky also says its security software is now capable of spotting the malware. Additionally, keeping Windows up to date – at the very least through installing March’s critical patch defending against the EternalBlue vulnerability – stops one major avenue of infection, and will also protect against future attacks with different payloads. 
 
 For this particular malware outbreak, another line of defence has been discovered: “Petya” checks for a read-only file, C:\Windows\perfc.dat, and if it finds it, it won’t run the encryption side of the software. But this “vaccine” doesn’t actually prevent infection, and the malware will still use its foothold on your PC to try to spread to others on the same network. 
 
 Why is it called “Petya”? 
 
 Strictly speaking, it is not. The malware appears to share a significant amount of code with an older piece of ransomware that really was called Petya, but in the hours after the outbreak started, security researchers noticed that “the superficial resemblance is only skin deep”. Researchers at Russia’s Kaspersky Lab redubbed the malware NotPetya, and increasingly tongue-in-cheek variants of that name – Petna, Pneytna, and so on – began to spread as a result. On top of that, other researchers who independently spotted the malware gave it other names: Romanian’s Bitdefender called it Goldeneye, for instance. 
 
 Hackers publish private photos from cosmetic surgery clinic Read more 
 
 Where did it start? 
 
 The attack appears to have been seeded through a software update mechanism built into an accounting program that companies working with the Ukrainian government need to use, according to the Ukrainian cyber police. This explains why so many Ukrainian organizations were affected, including government, banks, state power utilities and Kiev’s airport and metro system. The radiation monitoring system at Chernobyl was also taken offline, forcing employees to use hand-held counters to measure levels at the former nuclear plant’s exclusion zone. A second wave of infections was spawned by a phishing campaign featuring malware-laden attachments. 
 
 How far has it spread? 
 
 The “Petya” ransomware has caused serious disruption at large firms in Europe and the US, including the advertising firm WPP, French construction materials company Saint-Gobain and Russian steel and oil firms Evraz and Rosneft. The food company Mondelez, legal firm DLA Piper, Danish shipping and transport firm AP Moller-Maersk and Heritage Valley Health System, which runs hospitals and care facilities in Pittsburgh, also said their systems had been hit by the malware. 
 
 Crucially, unlike WannaCry, this version of ‘Petya’ tries to spread internally within networks, but not seed itself externally. That may have limited the ultimate spread of the malware, which seems to have seen a decrease in the rate of new infections overnight. 
 
 Facebook Twitter Pinterest Shipping company Maersk’s IT system was impacted by the cyber-attack. Photograph: Mauritz Antin/EPA 
 
 So is this just another opportunistic cybercriminal? 
 
 It initially looked like the outbreak was just another cybercriminal taking advantage of cyberweapons leaked online. However, security experts say that the payment mechanism of the attack seems too amateurish to have been carried out by serious criminals. Firstly, the ransom note includes the same Bitcoin payment address for every victim – most ransomware creates a custom address for every victim. Secondly, the malware asks victims to communicate with the attackers via a single email address which has been suspended by the email provider after they discovered what it was being used for. This means that even if someone pays the ransom, they have no way to communicate with the attacker to request the decryption key to unlock their files. 
 
 UK energy industry cyber-attack fears are 'off the scale' Read more 
 
 Who is behind the attack? 
 
 It is not clear, but it seems likely it is someone who wants the malware to masquerade as ransomware, while actually just being destructive, particularly to the Ukrainian government. Security researcher Nicholas Weaver told cybersecurity blog Krebs on Security that ‘Petya’ was a “deliberate, malicious, destructive attack or perhaps a test disguised as ransomware”. Pseudonymous security researcher Grugq noted that the real Petya “was a criminal enterprise for making money,” but that the new version “is definitely not designed to make money. 
 
 “This is designed to spread fast and cause damage, with a plausibly deniable cover of ‘ransomware,’” he added, pointing out that, among other tells, the payment mechanism in the malware was inept to the point of uselessness: a single hardcoded payment address, meaning the money can be traced; the requirement to email proof of payment to a webmail provider, meaning that the email address can be – and was – disabled; and the requirement to send an infected machine’s 60-character, case sensitive “personal identification key” from a computer which can’t even copy-and-paste, all combine to mean that “this payment pipeline was possibly the worst of all options (sort of ‘send a personal cheque to: Petya Payments, PO Box … ’)”. 
 
 Ukraine has blamed Russia for previous cyber-attacks, including one on its power grid at the end of 2015 that left part of western Ukraine temporarily without electricity. Russia has denied carrying out cyber-attacks on Ukraine. 
 
 What should you do if you are affected by the ransomware? 
 
 The ransomware infects computers and then waits for about an hour before rebooting the machine. While the machine is rebooting, you can switch the computer off to prevent the files from being encrypted and try and rescue the files from the machine, as flagged by @HackerFantastic on Twitter. 
 
 Hacker Fantastic (@hackerfantastic) If machine reboots and you see this message, power off immediately! This is the encryption process. If you do not power on, files are fine. pic.twitter.com/IqwzWdlrX6 
 
 If the system reboots with the ransom note, don’t pay the ransom – the “customer service” email address has been shut down so there’s no way to get the decryption key to unlock your files anyway. Disconnect your PC from the internet, reformat the hard drive and reinstall your files from a backup. Back up your files regularly and keep your anti-virus software up to date. 
 
 This article contains affiliate links, which means we may earn a small commission if a reader clicks through and makes a purchase. All our journalism is independent and is in no way influenced by any advertiser or commercial initiative. 
 
 The links are powered by Skimlinks. By clicking on an affiliate link, you accept that Skimlinks cookies will be set. More information. ||||| Cybereason security researcher Amit Serper has found a way to prevent the Petya (NotPetya/SortaPetya/Petna) ransomware from infecting computers. 
 
 The ransomware has been wreaking havoc across the globe today, locking hard drive MFT and MBR sections and preventing computers from booting. Unless victims opted to pay a ransom (which is now pointless and not recommended), there was no way to recover their systems. 
 
 In the first hours of the attack, researchers believed this new ransomware was a new version of an older threat called Petya, but they later discovered that this was a new strain altogether, which borrowed some code from Petya, hence the reason why they recently started it calling it NotPetya, Petna, or as we like to call it SortaPetya. 
 
 Researchers flocked to find killswitch mechanism 
 
 Because of the ransomware's global outreach, many researchers flocked to analyze it, hoping to find a loophole in its encryption or a killswitch domain that would stop it from spreading, similar to WannaCry. 
 
 While analyzing the ransomware's inner workings, Serper was the first to discover that NotPetya would search for a local file and would exit its encryption routine if that file already existed on disk. 
 
 The researcher's initial findings have been later confirmed by other security researchers, such as PT Security, TrustedSec, and Emsisoft. 
 
 This means victims can create that file on their PCs, set it to read-only, and block the NotPetya ransomware from executing. 
 
 While this does prevent the ransomware from running, this method is more of a vaccination than a kill switch. This is because each computer user must independently create this file, compared to a "switch" that the ransomware developer could turn on to globally prevent all ransomware infections. 
 
 How to Enable the NotPetya/Petna/Petya Vaccine 
 
 To vaccinate your computer so that you are unable to get infected with the current strain of NotPetya/Petya/Petna (yeah, this naming is annoying), simply create a file called perfc in the C:\Windows folder and make it read only. For those who want a quick and easy way to perform this task, Lawrence Abrams has created a batch file that performs this step for you. 
 
 For those who want a little more control or native executable that can make these changes, I have created a new vaccinator. This is native executable with extra options that may make it easier for those who want to customize which vaccination files are created, to remove vaccination files, and to suppress output for those who wish to use it as part of a login script or another script. The file can be downloaded from here: https://download.bleepingcomputer.com/vaccines/NotPetyaVaccine.exe It is a command line tool that when run without command line arguments will just create the C:\Windows\perfc file and exits. You can use the /h argument to see the full help file that contains info on how to customize its execution.. 
 
 Please note that he batch file will also create two addition vaccination files called perfc.dat and perfc.dll. While my tests did not indicate that these additional files are needed, I added them for thoroughness based on the replies to this tweet. 
 
 This batch file can be found at: https://download.bleepingcomputer.com/bats/nopetyavac.bat 
 
 For those who wish to vaccinate their computer manually, you can do so using the following steps. Please note that these steps are being created to make it as easy as possible for those with little computer experience. For those who have greater experience, you can do it in quite a few, and probably better, ways. 
 
 First, configure Windows to show file extensions. For those who do not know how to do this, you can use this guide. Just make sure the Folder Options setting for Hide extensions for known file types is unchecked like below. 
 
 Once you have enabled the viewing of extensions, which you should always have enabled, open up the C:\Windows folder. Once the folder is open, scroll down till you see the notepad.exe program. 
 
 Once you see the notepad.exe program, left-click on it once so it is highlighted. Then press the Ctrl+C ( ) to copy and then Ctrl+V ( ) to paste it. When you paste it, you will receive a prompt asking you to grant permission to copy the file. 
 
 Press the Continue button and the file will be created as notepad - Copy.exe. Left click on this file and press the F2 key on your keyboard and now erase the notepad - Copy.exe file name and type perfc as shown below. 
 
 Once the filename has been changed to perfc, press Enter on your keyboard. You will now receive a prompt asking if you are sure you wish to rename it. 
 
 Click on the Yes button. Windows will once again ask for permission to rename a file in that folder. Click on the Continue button. 
 
 Now that the perfc file has been created, we now need to make it read only. To do that, right-click on the file and select Properties as shown below. 
 
 The properties menu for this file will now open. At the bottom will be a checkbox labeled Read-only. Put a checkmark in it as shown in the image below. 
 
 Now click on the Apply button and then the OK button. The properties Window should now close. While in my tests, the C:\windows\perfc file is all I needed to vaccinate my computer, it has also been suggested that you create C:\Windows\perfc.dat and C:\Windows\perfc.dll to be thorough. You can redo these steps for those vaccination files as well. 
 
 Your computer should now be vaccinated against the NotPetya/SortaPetya/Petya Ransomware. 
 
 Additional reporting by Lawrence Abrams. 
 
 6/28/17 8:26AM EST: This article has been updated to clarify in more detail how the batch script works 
 
 Bleeping Computer Petya/NotPetya coverage: 
 
 Surprise! NotPetya Is a Cyber-Weapon. It's Not Ransomware 
 
 Petya Ransomware Outbreak Originated in Ukraine via Tainted Accounting Software 
 
 Vaccine, not Killswitch, Found for Petya (NotPetya) Ransomware Outbreak 
 
 Email Provider Shuts Down Petya Inbox Preventing Victims From Recovering Files 
 
 WannaCry Déjà Vu: Petya Ransomware Outbreak Wreaking Havoc Across the Globe ||||| Victims of the ongoing Petya cyberattack have paid £7,064 ($9,000) in Bitcoin to hackers so far to try and get their files back — but they won't have much luck. 
 
 The cyberattack broke out on Tuesday, impacting the Ukrainian government and banks, then spreading to a Russian oil company, advertising firm WPP, and other companies around the world. The attack takes the form of ransomware, malicious software that encrypts a user's files, then demands a payment in Bitcoin in exchange for decryption. 
 
 Victims posted screenshots of messages showing up on their computer screens, instructing them to send $300 worth of Bitcoin to a Bitcoin wallet address. They were also told to send their own Bitcoin wallet ID and "personal installation key", a unique identifier generated by the ransomware, to a dedicated email address. 
 
 According to Blockchain.info, which shows Bitcoin transaction data, there have been 36 payments to that Bitcoin address to date. 
 
 But the operator behind that email address, German firm Posteo, swiftly blocked access to that mailbox. The company said on Tuesday that people couldn't email the address, nor could hackers access it. That means hackers can't check who has paid them, nor can they release the key needed to decrypt a specific victim's files. 
 
 In short: Anyone who has paid the ransom is out of luck. 
 
 Get the latest Bitcoin price here.>> ||||| FRANKFURT/MOSCOW/KIEV (Reuters) - A new cyber virus spread from Ukraine to wreak havoc around the globe on Wednesday, crippling thousands of computers, disrupting ports from Mumbai to Los Angeles and halting production at a chocolate factory in Australia. 
 
 The virus is believed to have first taken hold on Tuesday in Ukraine where it silently infected computers after users downloaded a popular tax accounting package or visited a local news site, national police and international cyber experts said. 
 
 More than a day after it first struck, companies around the world were still wrestling with the fallout while cyber security experts scrambled to find a way to stem the spread. 
 
 Danish shipping giant A.P. Moller-Maersk (MAERSKb.CO) said it was struggling to process orders and shift cargoes, congesting some of the 76 ports around the world run by its APM Terminals subsidiary. 
 
 U.S. delivery firm FedEx Corp (FDX.N) said its TNT Express division had been significantly affected by the virus, which also wormed its way into South America, affecting ports in Argentina operated by China’s Cofco. 
 
 The malicious code locked machines and demanded victims post a ransom worth $300 in bitcoins or lose their data entirely, similar to the extortion tactic used in the global WannaCry ransomware attack in May. 
 
 More than 30 victims paid up but security experts are questioning whether extortion was the goal, given the relatively small sum demanded, or whether the hackers were driven by destructive motives rather than financial gain. 
 
 Hackers asked victims to notify them by email when ransoms had been paid but German email provider Posteo quickly shut down the address, a German government cyber security official said. 
 
 Ukraine, the epicenter of the cyber strike, has repeatedly accused Russia of orchestrating attacks on its computer systems and critical power infrastructure since its powerful neighbor annexed the Black Sea peninsula of Crimea in 2014. 
 
 The Kremlin, which has consistently rejected the accusations, said on Wednesday it had no information about the origin of the global cyber attack, which also struck Russian companies such as oil giant Rosneft (ROSN.MM) and a steelmaker. 
 
 “No one can effectively combat cyber threats on their own, and, unfortunately, unfounded blanket accusations will not solve this problem,” said Kremlin spokesman Dmitry Peskov. 
 
 ESET, a Slovakian company that sells products to shield computers from viruses, said 80 percent of the infections detected among its global customer base were in Ukraine, with Italy second hardest hit with about 10 percent. 
 
 ETERNAL BLUE 
 
 The aim of the latest attack appeared to be disruption rather than ransom, said Brian Lord, former deputy director of intelligence and cyber operations at Britain’s GCHQ and now managing director at private security firm PGI Cyber. 
 
 “My sense is this starts to look like a state operating through a proxy ... as a kind of experiment to see what happens,” Lord told Reuters on Wednesday. 
 
 While the malware seemed to be a variant of past campaigns, derived from code known as Eternal Blue believed to have been developed by the U.S. National Security Agency (NSA), experts said it was not as virulent as May’s WannaCry attack. 
 
 Security researchers said Tuesday’s virus could leap from computer to computer once unleashed within an organization but, unlike WannaCry, it could not randomly trawl the internet for its next victims, limiting its scope to infect. 
 
 Bushiness that installed Microsoft’s (MSFT.O) latest security patches from earlier this year and turned off Windows file-sharing features appeared to be largely unaffected. 
 
 There was speculation, however, among some experts that once the new virus had infected one computer it could spread to other machines on the same network, even if those devices had received a security update. 
 
 After WannaCry, governments, security firms and industrial groups advised businesses and consumers to make sure all their computers were updated with Microsoft (MSFT.O) security patches. 
 
 Austria’s government-backed Computer Emergency Response Team (CERT) said “a small number” of international firms appeared to be affected, with tens of thousands of computers taken down. 
 
 Slideshow (12 Images) 
 
 Security firms including Microsoft, Cisco’s (CSCO.O) Talos and Symantec (SYMC.O) said they had confirmed some of the initial infections occurred when malware was transmitted to users of a Ukrainian tax software program called MEDoc. 
 
 The supplier of the software, M.E.Doc denied in a post on Facebook that its software was to blame, though Microsoft reiterated its suspicions afterwards. 
 
 “Microsoft now has evidence that a few active infections of the ransomware initially started from the legitimate MEDoc updater process,” it said in a technical blog post. 
 
 Russian security firm Kaspersky said a Ukrainian news site for the city of Bakhumut was also hacked and used to distribute the ransomware to visitors, encrypting data on their machines. 
 
 CORPORATE CHAOS 
 
 A number of the international firms hit have operations in Ukraine, and the virus is believed to have spread within global corporate networks after gaining traction within the country. 
 
 Shipping giant A.P. Moller-Maersk (MAERSKb.CO), which handles one in seven containers shipped worldwide, has a logistics unit in Ukraine. 
 
 Other large firms affected, such as French construction materials company Saint Gobain (SGOB.PA) and Mondelez International Inc (MDLZ.O), which owns chocolate brand Cadbury, also have operations in the country. 
 
 Maersk was one of the first global firms to be taken down by the cyber attack and its operations at major ports such as Mumbai in India, Rotterdam in the Netherlands and Los Angeles on the U.S. west coast were disrupted. 
 
 Other companies to succumb included BNP Paribas Real Estate (BNPP.PA), a part of the French bank that provides property and investment management services. 
 
 “The international cyber attack hit our non-bank subsidiary, Real Estate. The necessary measures have been taken to rapidly contain the attack,” the bank said on Wednesday. 
 
 Production at the Cadbury factory on the Australian island state of Tasmania ground to a halt late on Tuesday after computer systems went down. 
 
 Russia’s Rosneft, one of the world’s biggest crude producers by volume, said on Tuesday its systems had suffered “serious consequences” but oil production had not been affected because it switched to backup systems. ||||| Image copyright Thinkstock 
 
 Security researchers have discovered a "vaccine" for the huge cyber-attack that hit organisations across the world on Tuesday. 
 
 The creation of a single file can stop the attack from infecting a machine. 
 
 However, researchers have not been able to find a so-called kill switch that would prevent the crippling ransomware from spreading to other vulnerable computers. 
 
 Experts are still unsure about the attack's origins or its real purpose. 
 
 Given that the ransom amount - $300 - was relatively small, some are speculating that the attack may be a front for causing wider disruption or making a political statement. 
 
 Among the victims of the attack were the Ukrainian central bank, Russian oil giant Rosneft, British advertising firm WPP and the global law firm DLA Piper. 
 
 Also caught up in the attack was at least one hospital in the US city of Pittsburgh. 
 
 A perfc solution 
 
 But for those concerned about the attack there appears to be fix, albeit one with limited effectiveness. 
 
 By creating a read-only file - named perfc - and placing it within a computer's "C:\Windows" folder, the attack will be stopped in its tracks. 
 
 An explanation of how to do this has been posted by security news website Bleeping Computer and has been backed up by several other security experts. 
 
 However, while this method is effective, it only protects the individual computer the perfc file is placed on. Researchers have so far been unable to locate a kill switch that would disable the ransomware attack entirely. 
 
 Image copyright Screenshot Image caption Many reports suggest that screens around the world are getting this message showing the ransomware threat 
 
 "Even though it will make a machine 'immune'," explained computer scientist Prof Alan Woodward, "It is still a 'carrier' (to use the biological analogy). 
 
 "It will still act as a platform to spread the ransomware to other machines on the same network." 
 
 For the vast majority of users, simply running an up-to-date version of Windows will be sufficient to prevent the attack taking hold, were it to infect your PC. 
 
 The spread of this new ransomware is likely to be much slower than last month's WannaCry attack, researchers predict, as code analysis showed the new attack did not attempt to spread itself beyond the network it was placed on. 
 
 Because of this, several experts are predicting that the attack will not spread significantly further than it did on Tuesday, unless it is modified. 
 
 "There is low risk of new infections more than one hour after the attack," suggested the MalwareTech blog. 
 
 MeDoc fear 
 
 So how did it spread? Experts from Cisco's Talos intelligence unit said it believed the attack may have been carried out by exploiting vulnerable accounting software. 
 
 "We believe it is possible that some infections may be associated with software update systems for a Ukrainian tax accounting package called MeDoc," the company said in a blog post. 
 
 MeDoc initially posted an update to its website on Tuesday saying, in Russian, "Attention! Our server made a virus attack" - though this was later removed, and the company has since denied its software was exploited. 
 
 As reported on Tuesday, the method by which victims can pay the ransom fee has been rendered useless. An email address provided by the criminals has been shut down by the hosting provider, while the Bitcoin wallet - where ransoms are deposited - has not been touched. 
 
 At the time of writing, the wallet contains approximately $8,000-worth of Bitcoin, not a large return for such a significant and widespread attack. 
 
 These factors contribute to a now-prevailing theory that this was a politically motivated attack on Ukraine, coming as it did just as the country is set to celebrate its Constitution Day. 
 
 "This looks like a sophisticated attack aimed at generating chaos, not money," said Prof Woodward. 
 
 ___________ 
 
 Follow Dave Lee on Twitter @DaveLeeBBC 
 
 You can reach Dave securely through encrypted messaging app Signal on: +1 (628) 400-7370
– Security researchers have been unable to find a "kill switch" for the latest cyberattack hitting systems around the world—but they have developed a vaccine. Researchers say that the Petya ransomware will not encrypt files on computers that have the read-only file "C:\Windows\perfc.dat," the BBC reports. A guide on how to set that up can be found here, though security experts say people running up-to-date versions of Windows will already be protected. And the fix isn't perfect: Researchers warn that although the "vaccination" will make individual computers immune to the attack, the computers could still become "carriers" capable of spreading the malware to others. The cyberattack, which is believed to have originated in a software update for a Ukrainian tax accounting system, spread rapidly around the world Tuesday, with victims including India's largest container port, Russia's biggest oil company, a chocolate factory in Tasmania, and a hospital in Pittsburgh, reports Reuters. The malware encrypted hard drives and demanded $300 in bitcoin to restore files. Around 30 people paid up, though the mailbox involved has now been blocked, Business Insider reports. Analysts tell the Guardian that the low financial return and ineffective payment mechanism suggest that the attack was designed not to make money but to cause chaos in Ukraine, the most affected country.