How to protect from wcrypt (Wanna Cry)?

How to protect from wcrypt (Wanna Cry)?

May 14, 2017   by SecuritySofts

1. Windows Update MS17-010

The virus uses ETERNALBLUE exploit, which is closed by Microsoft security update MS17-010 released in March. I recommend that you check update center for presence of such an update (by code) on your computer (for example, code for Windows 7 will be KB4012212 or KB4012215).

If updates are not installed, you can download them from official Microsoft website:

https://technet.microsoft.com/en-us/library/security/ms17-010.aspx

For older systems (Windows XP, Windows Server 2003 R2), Microsoft released special patches:

https://blogs.technet.microsoft.com/msrc/2017/05/12/customer-guidance-for-wannacrypt-attacks/

2. Close ports 135 and 445

According to the reports of antivirus companies, wcrypt penetrates computers through SMB (Server Message Block) ports. To prevent penetration, we block the ports 135 and 445 through which the virus penetrates (in most cases they are not used by ordinary users).

To do this, open the console with administrator rights (cmd.exe -> run as administrator). And we execute in turn 2 commands (after each command there should be status OK).

netshadvfirewall firewall add rule dir=in action=block protocol=TCP localport=135 name=”Block_TCP-135″

netsh advfirewall firewall add rule dir=in action=block protocol=TCP localport=445 name=”Block_TCP-445″

3. Disabling SMBv1 support

The vulnerability can also be closed by completely disabling SMBv1 support. Run this command in cmd (run as administrator).

dism /online /norestart /disable-feature /featurename:SMB1Protocol