Malware · critical

How to fix WannaCry Ransomware Cryptoworm

Malware troubleshooting guide

What this error means

WannaCry is a notorious ransomware cryptoworm that targeted computers running Microsoft Windows by encrypting data and demanding ransom payments in Bitcoin. It propagates using the EternalBlue exploit (CVE-2017-0144) in the SMBv1 protocol.

Updated

Before you begin

Save open work and back up important files. Use instructions for your exact device and software version. If Windows cannot start, see the startup guide.

Work through these checks

0 of 4 complete
01Install MS17-010 security update immediately
  1. Install MS17-010 security update immediately
What to expect

Check whether the original symptom still occurs.

If it does not help

Continue only if this check applies to your device. Consult its manufacturer if you are unsure.

Browse related errors
02Disable the legacy SMBv1 protocol in Windows Features
  1. Disable the legacy SMBv1 protocol in Windows Features
What to expect

Check whether the original symptom still occurs.

If it does not help

Continue only if this check applies to your device. Consult its manufacturer if you are unsure.

Browse related errors
03Block SMB ports (139, 445) at the network firewall
  1. Block SMB ports (139, 445) at the network firewall
What to expect

Check whether the original symptom still occurs.

If it does not help

Continue only if this check applies to your device. Consult its manufacturer if you are unsure.

Browse related errors
04Restore encrypted files from a verified offline backup
  1. Restore encrypted files from a verified offline backup
What to expect

Check whether the original symptom still occurs.

If it does not help

Continue only if this check applies to your device. Consult its manufacturer if you are unsure.

Browse related errors

Possible causes

  • Unpatched Windows systems with SMBv1 enabled
  • Exposure of port 445 directly to the internet
  • Lack of endpoint security monitoring