The bad news is that if you do get infected by mistake, you might not be able to recover your computer at all, even if you are willing to negotiate with the crooks. Nevertheless, Mamba is interesting because the creators quite clearly set out to try something a bit different and see what happened. Petya left the bulk of your raw data unscrambled at the sector level, albeit tantalisingly out of reach. Mamba takes the approach of ransoming your whole disk one step further: it scrambles every disk sector, including the MFT, the operating system, your apps, any shared files and all your personal data, too. Ironically, Mamba does all of this with very little programming effort: the malware simply installs and activates a pirated copy of the open source software. In fact, the most recent version of DiskCryptor dates from just two months after the TrueCrypt developers , and the DiskCryptor website still compares itself with the long-defunct TrueCrypt. Renato Marinho, a security researcher from Brazil, recently an investigation he did into a real-world Mamba infection at a multinational company, but even in that case he was unable to track down how the malware got inside the organisation in the first place. Ransomware crooks have found this sort of email a tempting and effective lure to attack home users and businesses alike. After a short while, your computer will spontaneously reboot, which you can think of as your second red flag: Before rebooting, the Mamba program surreptitiously installs itself as a Windows service with the name DefragmentationService and with LocalSystem privileges. Notably, the Mamba service has the credentials to install a low-level FDE program like DiskCryptor quietly in the background, which is exactly what it does after rebooting. Older operating system versions and older hard disks used a format called MBR, short for Master Boot Record, that allowed four partitions per disk and a maximum disk size of 2 terabytes. These days, most installations use a similar-but-different disk layout called GUID Partition Table, or GPT for short, which supports 128 partitions of sizes up to billions of terabytes. Mamba, however, installs DiskCryptor anyway. Next time, perhaps consider using some sort of , and consider figuring out a sustainable plan to keep full, offline backups. So, as always, prevention is way better than cure, not least because in this case there may not actually be a cure, neither for love nor for money. The nuances of the GPT vs. Your approach is more likely to get a casual reader interested and engaged in topics that they are likely unaware of, and better understand the inner workings of technology. In an otherwise good article — this error sticks out like a sore thumb. Open source software depends on the community adhering to the standards and conditions applied to its development and use.
