How to protect from wcrypt (Wanna Cry)?

ransomware on paper blueprint background, technology concept

The virus uses ETERNALBLUE exploit, which is closed by Microsoft security update MS17-010 released in March. I recommend that you check update center for presence of such an update (by code) on your computer (for example, code for Windows 7 will be KB4012212 or KB4012215).

If updates are not installed, you can download them from official Microsoft website:

https://technet.microsoft.com/en-us/library/security/ms17-010.aspx

For older systems (Windows XP, Windows Server 2003 R2), Microsoft released special patches:

https://blogs.technet.microsoft.com/msrc/2017/05/12/customer-guidance-for-wannacrypt-attacks/




Close ports 135, 139 and 445

According to the reports of antivirus companies, wcrypt penetrates computers through SMB (Server Message Block) ports. To prevent penetration, we block the ports 135, 139 and 445 through which the virus penetrates (in most cases they are not used by ordinary users).

To do this, open the console with administrator rights (cmd.exe -> run as administrator). And we execute in turn 3 commands (after each command there should be status OK).

Disabling SMBv1 support




The vulnerability can also be closed by completely disabling SMBv1 support. Run this command in cmd (run as administrator).

Or

Leave a Reply

Your email address will not be published. Required fields are marked *