When i wrote this question in SuperUser there was not any information and solution about Wanna Cry attack in SuperUser. So this is not a duplicate question and has special information and useful solutions for you about Wanna Cryattack.

  • How to protect my Windows (Client|Server) from the popular Wanna Cry (Wanna Crypt)?
  • What to do if my system is affected to WannaCry?
  • How to remove it?
  • How Wanna Cry work?

WannaCry screenshot 1WannaCry screenshot 2

  • Basically you need to reformat you system, and start over to make sure you get rid of it. If you pay, your money might be used to fund illegal activities such as terrorism, so society is better off if you just lose your files. You should have backups to restore them from anway, right?? If nobody pays,ever, they will stop doing it.
    – cybernard
    May 16 '17 at 23:47
  • @JakeGould, NO it is very different from the question that you mentioned! this is a special question about Wanna Cry! With special answer about Wanna Cry!
    – RAM
    May 16 '17 at 23:59
  • 1
    @RAM It makes no difference. Malware and viruses change all the time. Approaches on how to deal with them are varied and similar. If Stack Exchange wanted to create a special site just for the details of every piece of malware/viruses out there then this answer would make sense. As it stands it’s not really anything more than a “panic of the moment” question that is very well covered elsewhere on the Internet including the Microsoft site you copied the answer from verbatim with little to no edits. May 17 '17 at 1:06
  • @JakeGould, If you let, I am sure this Q&A will help many people these days and will be a good references to prevent systems from Wanna Cry.
    – RAM
    May 17 '17 at 1:26
  • @RAM: And that question is also closed there as: “put on hold as off-topic”. Also, you state, “…one of the most dangerous attacks.” It’s not dangerous if your system is patched. And there are tons of past examples of malware that were considered dangerous as well. Posting a thread on StackExchange won’t help most people since there are already TONS of sites including Microsoft’s site that directly addresses the issue. You are not adding anything but noise to the issue. May 17 '17 at 2:50

Protect your Windows (Server|Client) from Wanna Cry

What is Wanna Cry attack?

enter image description here

The WannaCry ransomware attack is an ongoing cyberattack of the WannaCry (or WannaCrypt, WanaCrypt0r 2.0, Wanna Decryptor) ransomware computer worm targeting the Microsoft Windows operating system.

The attack started on Friday, 12 May 2017, infecting more than 230,000 computers in 150 countries, with the software demanding ransom payments in the cryptocurrency bitcoin in 28 languages. The attack has been described by Europol as unprecedented in scale.



☼ How to protect my Windows?

Don't worry, just follow bellow instructions:

  • A) Run your Windows Update from control panel and get last updates and install them.

Microsoft says: A wide-spread ransomware attack, WannaCrypt, targets out-of-date Windows devices. Given the severity of this threat, immediately update your Windows devices.

  • B) Disable SMBv1 feature of your windows. For any reason if you can not get latest updates of window, then disable SMBv1 feature.

EternalBlue exploits vulnerability MS17-010 in Microsoft's implementation of the Server Message Block (SMB) protocol.

  • C) Consider adding a rule on your router or firewall to block incoming SMB traffic on port 445

  • D) Windows Defender Antivirus detects this threat as Ransom:Win32/WannaCrypt as of the update. Windows Defender Antivirus uses cloud-based protection, helping to protect you from the latest threats. .

How to block incoming SMB traffic on port 445 Lunch the windows Cmd (Run As Administrator) and write the following command:

netsh advfirewall firewall add rule dir=in action=block protocol=TCP localport=445 name="Block_TCP-445"


☼ How to gracefully remove SMB v1 in Windows 8.1, Windows 10, Windows 2012 R2, and Windows Server 2016

  • Windows Server: Server Manager method

enter image description here

  • Windows Server: PowerShell method (Remove-WindowsFeature FS-SMB1)

enter image description here

  • Windows Client: Add or Remove Programs method (Turn On/Off Windows Features)

enter image description here

  • Windows Client: PowerShell method (Disable-WindowsOptionalFeature -Online -FeatureName smb1protocol)

enter image description here


☼ What to do if my system is affected?


Don't reboot your system and test this WanaCry Removers:

There is no one-size-fits-all response if you have been victimized by ransomware. There is no guarantee that paying the ransom will give you access to your files.

If you've already paid, see our ransomware page for help on what to do now.

Run antivirus or antimalware software

Use the following free Microsoft software to detect and remove this threat:

Use cloud protection

Use cloud protection to help guard against the latest malware threats. It’s turned on by default for Microsoft Security Essentials and Windows Defender for Windows 10.

To check if it's running, go to All settings > Update & security > Windows Defender and make sure that your Cloud-based Protection settings is turned On.

☼ How it work?

Read here...

  • 'Set-SmbServerConfiguration -EnableSMB1Protocol $false' is a better command to disable SMBv1
    – Ramhound
    May 17 '17 at 0:54

Not the answer you're looking for? Browse other questions tagged or ask your own question.