1-703-230-2300 — sales@virtualadministrator.com
Nopetya Vaccination and Immunization

Performs the Vaccination as described in this article, by creating a few read only files which should prevent NotPetya/Petya/Petna/SortaPetya infections.
<?xml version="1.0" encoding="utf-8"?>
<ScriptExport xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns="http://www.kaseya.com/vsa/2008/12/Scripting">
  <Procedure name="Nopetya Vaccination and Immunization" treePres="3" id="403211525" folderId="491791698006816" treeFullPath="myProcedures - NetworkDepot.Kyle.Test 2017">
    <Body description="Script Name: NoPetya Vaccination&#xA;Script Desc: Creates a few read-only files which will prevent Petna variety ransomware. Can report on results using $NoPetya$.&#xA;&#xA;Date: 6/28/2017&#xA;Company: VirtualAdministrator&#xA;Author: Kyle&#xA;Acknowledgments:&#xA;&#xA;(c) Copyright 2017 Network Depot, LLC (Virtual Administrator) ALL RIGHTS RESERVED.   This script is the property of Network Depot, LLC (dba VirtualAdministrator), and use is restricted to active clients.  Do not re-distribute without written authorization.">
      <If description="">
        <Condition name="TestFile">
          <Parameter xsi:type="StringParameter" name="Path" value="C:\Windows\perfc" />
          <Parameter xsi:type="EnumParameter" name="Condition" value="Exists" />
          <Parameter xsi:type="StringParameter" name="Value" value="" />
        </Condition>
        <Then>
          <Statement name="WriteScriptLogEntry" continueOnFail="false">
            <Parameter xsi:type="StringParameter" name="Comment" value="System is already vaccinated against NotPetya/Petya/Petna/SortaPetya. $Petya$" />
          </Statement>
        </Then>
        <Else>
          <Statement name="ExecuteShellCommand" continueOnFail="false">
            <Parameter xsi:type="StringParameter" name="Command" value="echo This is a NotPetya/Petya/Petna/SortaPetya Vaccination file. Do not remove as it protects you from being encrypted by Petya. &gt;&gt; C:\Windows\perfc" />
            <Parameter xsi:type="EnumParameter" name="ExecuteAccount" value="System" />
            <Parameter xsi:type="BooleanParameter" name="Is64Bit" value="False" />
          </Statement>
          <Statement name="ExecuteShellCommand" continueOnFail="false">
            <Parameter xsi:type="StringParameter" name="Command" value="attrib +R C:\Windows\perfc" />
            <Parameter xsi:type="EnumParameter" name="ExecuteAccount" value="System" />
            <Parameter xsi:type="BooleanParameter" name="Is64Bit" value="False" />
          </Statement>
          <Statement name="ExecuteShellCommand" continueOnFail="false">
            <Parameter xsi:type="StringParameter" name="Command" value="echo This is a NotPetya/Petya/Petna/SortaPetya Vaccination file. Do not remove as it protects you from being encrypted by Petya. &gt;&gt; C:\Windows\perfc.dll" />
            <Parameter xsi:type="EnumParameter" name="ExecuteAccount" value="System" />
            <Parameter xsi:type="BooleanParameter" name="Is64Bit" value="False" />
          </Statement>
          <Statement name="ExecuteShellCommand" continueOnFail="false">
            <Parameter xsi:type="StringParameter" name="Command" value="attrib +R C:\Windows\perfc.dll" />
            <Parameter xsi:type="EnumParameter" name="ExecuteAccount" value="System" />
            <Parameter xsi:type="BooleanParameter" name="Is64Bit" value="False" />
          </Statement>
          <Statement name="ExecuteShellCommand" continueOnFail="false">
            <Parameter xsi:type="StringParameter" name="Command" value="echo This is a NotPetya/Petya/Petna/SortaPetya Vaccination file. Do not remove as it protects you from being encrypted by Petya. &gt;&gt; C:\Windows\perfc.dat" />
            <Parameter xsi:type="EnumParameter" name="ExecuteAccount" value="System" />
            <Parameter xsi:type="BooleanParameter" name="Is64Bit" value="False" />
          </Statement>
          <Statement name="ExecuteShellCommand" continueOnFail="false">
            <Parameter xsi:type="StringParameter" name="Command" value="attrib +R C:\Windows\perfc.dat" />
            <Parameter xsi:type="EnumParameter" name="ExecuteAccount" value="System" />
            <Parameter xsi:type="BooleanParameter" name="Is64Bit" value="False" />
          </Statement>
          <Statement name="WriteScriptLogEntry" continueOnFail="false">
            <Parameter xsi:type="StringParameter" name="Comment" value="System is now vaccinated against NotPetya/Petya/Petna/SortaPetya. $Petya$" />
          </Statement>
        </Else>
      </If>
    </Body>
  </Procedure>
</ScriptExport>
Nopetya Vaccination and Immunization

How to Download a Script

Login

Search

Get In Touch!

Additional Resources

About Us
