Malware · critical

How to fixWANNACRY_RANSOMWARE

WannaCry Ransomware Cryptoworm

What this error means

WANNACRY_RANSOMWARE shows up as a critical-severity malware/security fault. WannaCry is a notorious ransomware cryptoworm that targeted computers running Microsoft Windows by encrypting data and demanding ransom payments in Bitcoin. It propagates using the EternalBlue exploit (CVE-2017-0144) in the SMBv1 protocol. It's most often caused by exposure of port 445 directly to the internet and lack of endpoint security monitoring. Follow the steps below to fix it.

Before you begin

Save open work and back up important files. Note any recent driver or hardware changes. If Windows cannot start, use the startup guide first.

Work through these checks

0 of 4 complete
01Install MS17-010 security update immediately

Install MS17-010 security update immediately.

Use the instructions for your exact device and operating system. Check the manufacturer’s documentation before changing firmware, hardware, or system settings.

I need help
02Disable the legacy SMBv1 protocol in Windows Features

Disable the legacy SMBv1 protocol in Windows Features.

Use the instructions for your exact device and operating system. Check the manufacturer’s documentation before changing firmware, hardware, or system settings.

I need help
03Block SMB ports (139, 445) at the network firewall

Block SMB ports (139, 445) at the network firewall.

Use the instructions for your exact device and operating system. Check the manufacturer’s documentation before changing firmware, hardware, or system settings.

I need help
04Restore encrypted files from a verified offline backup

Restore encrypted files from a verified offline backup.

Use the instructions for your exact device and operating system. Check the manufacturer’s documentation before changing firmware, hardware, or system settings.

I need help

Possible causes

  • Unpatched Windows systems with SMBv1 enabled
  • Exposure of port 445 directly to the internet
  • Lack of endpoint security monitoring