WannaCry Ransomware Cryptoworm

What is WANNACRY-RANSOMWARE?

WANNACRY_RANSOMWARE shows up as a critical-severity malware/security fault. WannaCry is a notorious ransomware cryptoworm that targeted computers running Microsoft Windows by encrypting data and demanding ransom payments in Bitcoin. It propagates using the EternalBlue exploit (CVE-2017-0144) in the SMBv1 protocol. It's most often caused by exposure of port 445 directly to the internet and lack of endpoint security monitoring. Follow the steps below to fix it.

Common Causes

• Unpatched Windows systems with SMBv1 enabled
• Exposure of port 445 directly to the internet
• Lack of endpoint security monitoring

Step-by-Step Fix Guide

• 1
  Install MS17-010 security update immediately

  "Install MS17-010 security update immediately" is worth trying when lack of endpoint security monitoring turns out to be the culprit.

• 2
  Disable the legacy SMBv1 protocol in Windows Features

  If earlier steps didn't help, "Disable the legacy SMBv1 protocol in Windows Features" directly addresses unpatched Windows systems with SMBv1 enabled.

• 3
  Block SMB ports (139, 445) at the network firewall

  For lingering WANNACRY-RANSOMWARE cases, "Block SMB ports (139, 445) at the network firewall" is worth running through.

• 4
  Restore encrypted files from a verified offline backup

  "Restore encrypted files from a verified offline backup" handles an edge case some users report with WANNACRY-RANSOMWARE.

Commands & Diagnostics

Frequently Asked Questions