Trojan.Ransom.WannaCrypt (WanaCrypt0r 2.0/WannaCry, NHS Ransomware)

/ danooct1
/ danooct1
a few links for further (and interesting) reading: www.malwaretec...
www.theguardia...
major thanks to malwaretech team for stopping the ransomware in its tracks, xylitol for the hookup once again, and all of you who took the time to message me about the ransomware.
Thanks to the following $5+ patrons!
John Kizer
Numou
crymera
handsome jack
Thomas H Khoury
Joshua Mack
Mister Sparkly
Jade
squigly-kip
Matthew K
Alice J
Renaud Bedard
Blaise
Sleepy Owl
Rosenator
Robert G
Si Mellor
BluePolar Bearz

[@AwesumIndustrys]

You know it's serious shit when obsolete software gets patched.

[@DMack6464]

Are they gonna release a patch for Windows 95?

[@cam6656]

microsoft still cares about xp, so you can still use it :)

[@b_28282]

Cam No they don't

[@CWINDOWSsystem32]

+InfernoDukem It's pretty much a fact that Windows XP is obsolete by now...

[@johnl.38]

pretty sure gas stations still run XP on pumps and ATMs may also do the same

[@DrachenYT]

When you hit that point in your life where it wouldn't even matter if you got hit by this because worst case scenario you just lose your memes.

[@b_28282]

But my Minecraft worlds would be gone too!!! *_*pays 0.17 BTC_**

[@chcikety]

I actually did lose my memes to ransomeware :( It was devestating... I hate those boogerheads >:(

[@bitelaserkhalif]

Drachen you lose the moddig projects

[@BigOlSmellyFlashlight]

Drachen I lose all my animations and backups from 2013

[@w4str]

true my friend

[@EthanBB]

Actually, there is absolutely no point to pay the ransom. It has only 3 bitcoin addresses hardcoded into program (shown randomly) and there is no way attacker could recognize the payment was from you. Meaning there was never any intention to be able to decrypt the files.

[@White_Tiger93]

so how do you solve this problem without resort to pay them??

[@stedmangg]

*you don't*

[@karlkastor]

@@White_Tiger93 wait till someone writes a decryption program and/or the decryption keys leak. I believe there is already free decryption software for WannaCry out there. Sometimes the keys needed for decryption are still in the RAM of the computer, so there might be software that can get the keys, but it only works a short time after the malware was started.

[@GRBtutorials]

@@White_Tiger93 Restore from backup. Because you have a backup, don't you?

[@patriotapatriotski4809]

I was wondering can u use safe mode in this situation ???

[@itsdustyy598]

You have a girlfriend? Me- I used to have one, but she Ransomewhere.

[@PsychoFizz]

ItsDustyy I laughed harder than necessary at this.

[@FrigidBirostrixRay]

ItsDustyy LMAO

[@WhoLetTheDogOut]

ItsDustyy Really? Only 10 Likes? That was freaking clever and funny!

[@goodbyetothemaskedme]

ItsDustyy I'm laughing harder than I should be 😂😂

[@manaralameri1650]

ItsDustyy it’s true, she ran some where, and you have to pay her or else she leaves you.

[@Wozobb]

The interesting thing about the kill-switch is that it's actually a poorly implemented sandbox test. Malware authors want to thwart security researchers for as long as possible to delay any attempt at a countermeasure, and one technique for doing so is refusing to run in any sandboxed virtual machine environment. Sandboxes for malware often give it everything they want in order to analyze it to the fullest extent possible: for instance, if something wants to access a domain, the sandbox will give it something to connect to, whether or not it exists on the real Internet. Thus, if WannaCrypt manages to connect to a domain that it thinks doesn't exist, it'll conclude that it's being monitored and self-terminate. Normally, malware of this kind randomly generates the domains to be checked, but the author of WannaCrypt hard-coded it into the program instead, meaning that since someone registered the domain in the real world, it always mistakenly thinks that it's being run in a VM, whether or not it actually is.

[@aamyushh]

thank you for this i have been wondering for hours now and its 4am and am deep down a rabbithole

[@smashi4088]

that's a super clever strategy, good thing whoever made this didn't think of that

[@CWINDOWSsystem32]

Hey, props to Microsoft for actually releasing a patch for XP for this. Pretty ridiculous that some government systems are still running a 16 year-old unsupported OS though...

[@QuantumEcho7]

CWINDOWSsystem32 I guess it's cheaper for our stupid government

[@CWINDOWSsystem32]

+QEproductions7 I hope they learned their lesson from this and actually hire some decent IT people and upgrade the systems to at least Windows 7...

[@QuantumEcho7]

CWINDOWSsystem32 I suppose they're too busy sitting back and waiting for their victory in the election to care about the country lol

[@danem2215]

The United States ran its entire nuclear missile command from 50 year old 8" floppy drives until like 6 months ago

[@notgray88]

My high school was still running windows 98 just 3 years ago lmao.

[@Zyzzywyz]

Lol, "It's rich af" in the Rich Text document.

[@astonio9693]

@@potato_x69 "it's poor af"

[@austyn.l6289]

Ooops, this comment has been encrypted!

[@b_28282]

WHERE DO I SEND MY BITCOINS?!

[@andy56duky]

/b/ 28282 ah shit. my ass got encrypted as well.

[@adamwilderspin7854]

Austyn LeDrew How many bit coins to decrypt it...?

[@Komeiji0401]

Here is a key to decrypt your comment: hssianaizbwhu72!*hwnai;#!isn8#!@62;#8$;

[@michaelbaterna8386]

Error: File not found

[@rougeamp1]

this is how the civil war started

[@rorschachdaws7505]

rougeamp you mean world war 3

[@k1t13rr]

rougeamp which civil war

[@Leurak]

If it works without the network connected, where is the decryption key saved?

[@mrdaxtercrane]

It's so early into investigation, I would assume they didn't know.

[@realcomputerdude100]

I would imagine that it attempts to send it, fails, and continues to delete the key.

[@OGZClanChannel]

that's a really good question lmao

[@LiEnby]

run it in sandboxie and check?

[@abcddd32123]

@thecomputerman100 ^this

[@pcsecuritychannel]

They have come up with a newer version that doesn't have the killswitch. Another wave may be coming soon. Hopefully people are patched up.

[@bruhblox_]

7 years later lol

[@baradragonsftw9310]

*viruses, years ago: haha i wrecked your computer, lol, you lost everything* *viruses now: pls give me money*

[@AWISECROW]

NotPetya: pls give me money (wrecked your computer, lol, you lost everything anyway)

[@daniloaltamera8385]

PandoTech:Hold my beer

[@OiranDaki]

@Floppy 6022 ???

[@ABC-in2le]

Viruses now: MEEEEEEEMZ

[@GodzillaKaijuGK]

@@ABC-in2le there should be a MEMZ computer epidemic

[@rcollosi]

i remember when this was the biggest threat to your computer. feels just like yesterday, even though it was 4 years ago

[@Solaceon]

Don't worry, ransomware is still going strong.

[@jadegecko]

Here I was, thinking of you as a retro '90s-virus connoisseur. And here you are on the bleeding edge of world news. Albeit world news that affects people with badly out of date systems... Anyway, you're awesome. It's really neat to get to see this stuff in a context that's not dangerous or malicious in nature.

[@burrito64burrito64]

Hey Danooct1 you should have put the blog post Microsoft put on their webpage. It's almost like a middle finger to the NSA

[@SimplyChem32]

blogs.microsoft.com/on-the-issues/2017/05/14/need-urgent-collective-action-keep-people-safe-online-lessons-last-weeks-cyberattack/#sm.0000otkst81x2dg2rb51g3fgd0f6k There's the full blog post from their site, 8th paragraph down talks about the NSA.

[@userPrehistoricman]

Then why don't you link it???

[@Scootaloose]

That kind of comment is the same kind of crap you see on support forums when someone goes "found the problem it's fixed now" but never posts the solution. Link in question: blogs.microsoft.com/on-the-issues/2017/05/14/need-urgent-collective-action-keep-people-safe-online-lessons-last-weeks-cyberattack/

[@burrito64burrito64]

Prehistoricman I posted a reply with a link to it, but I think it get deleted as spam. The link appears on my screen right below my comment. Can you see it?

[@Werwa_]

burrito64burrito64 nope. Try adding a space in between the link and the ".com" or something

[@sewertendo]

Just a tidbit on why XP was patched. It's because of companies that still use XP tend despite the vulnerabilities. They usually set up individual contracts with Microsoft for this type of thing so that they can have some kind of extended support, although usually they have some kind of endpoint based security that filters most of the uninvited stuff. Part of it is to cut costs, or because certain applications simply won't work with newer OSes (so it's not just the OS you would be changing). There have obviously been ransomware in the past, but normally the network layers of security would be sufficient for it. This is why XP got patched despite the lack of support. Unless you're one of these organizations, don't freakin' use XP.

[@MaximilienNoal]

Biggerboot I use XP from time to time on a dedicated retro computer. I even use Windows 98SE. It's the bomb for 3dfx games. And of course both have network shares 'cause it's convenient. The key here is that there is nothing important on it and it's offline most of the time, with Wake On Lan disabled. :p

[@sewertendo]

Absolutely. If you're using it in those capacities then you obviously know what you're doing. I'm just a little worried when I see comments like "DOZ THIS MEEN XPEE IZ SPPRTD AGIN?" I mean I guess it's youtube comments and it could be sarcastic, but ultimately misinforming. :P

[@omni9030]

The memories of WannaCrypt for me are amazing! Being only a child at the time and seeing a red screen of death, I was terrified. We subsequently had a friend come over to fix this supposed virus, but I never touched that same computer again >:c

[@Belchmaster41]

this is what happens when you don't have Norton's Smart Firewall engaged

[@SirajRaval]

bro 200K views in 2 days god status

[@chessemchesse3676]

Damn

[@CharismaticEmoji]

and now there is only still somehow 797,034 views.

[@itzameh2233]

Its been 4 years.... :p

[@susmouse9494]

@@itzameh2233 And its not so far from the 797 000 views!

[@unsatisfiedfans7422]

I just want to thank you because your computer virus highlight videos (especially on ransomwares) are the inspiration for my thesis on computer virus

[@BlinkLed]

It's the new Captain Crunch cereal, "Oops, All Ransomware"

[@radioactivian]

jokes on you I speak enchantment table

[@ChaseMC215]

That's nice, Captain. But oh that time you fucked up and your cereal was just All Berries?

[@InterstellarVulpine]

Any virus that wants to get between me and my lego memes is going to get what's coming to it.

[@bigbadbootydad6633]

「#1 Schemer」 Megabloks FOR LIFE

[@sir.sleepsalot2711]

lmao made my day

[@burgerdiverbanandodansparc9154]

I actually wanna know that Mushroom Chicken recipe, if you're okay with that.

[@InterstellarVulpine]

Daniel Scharn You can't have it anymore, you gotta pay 300$ in bitcoins first D:

[@burgerdiverbanandodansparc9154]

I only got $7

[@a1goldenrunner]

Daniel Scharn how about $12?!

[@InterstellarVulpine]

Daniel Scharn I'm sure they will let you have those files, that mushroom chicken recipe is needed for the greater good of humanity.

[@matcoproductionsinc.282]

「Big Ol' Bear」 bitch coins you mean?

[@ShiningLuma90]

TempleOS doesn't have this problem

[@kutsuro3901]

too soon?

[@badcop9604]

MS-DOS doesn't have this problem

[@ggffd3704]

templeos has the problem of being able to rewrite mbr in a line

[@SandboxerSandy]

@@potato_x69 bruh why the fuck do you hate weebs

[@quizzys7106]

@@potato_x69 lmao

[@Jamesthe1]

I never knew it had a killswitch. Very good; this thing actually put cancer patients' lives in danger.

[@Leurak]

yes

[@PanPakaPanKancolleisgud]

Hey it's memz guy, when did you start watching Danooct?

[@byRKZY]

Jack He is he's number one fan. :p

[@plushifoxed]

danooct literally did the first video out there on memz you dingdong

[@ThatLinuxDude]

Hey man

[@michaelbaterna8386]

CONFURMED: teh memz guyy is the cRator off waanay cripty ransomwore

[@AllHailNannerpuss]

#18 on Trending. My nigga Dan made it

[@poke548]

I know, I felt so proud when I saw it.

[@CWINDOWSsystem32]

+Tornexted No, but Matt is...

[@GRBtutorials]

"We will decrypt your file because nobody will trust us if we cheat users" That has to be the lamest reason I've ever heard! Nobody trusts them!

[@whoismatteo3737]

I hate the way that ransomware makes me feel... it's so creepy, it gives me this sort of "dark, doomed" vibe

[@chm_mmx]

This malware uses two critical flaws. One is MS13-010 that has been patched for every Windows since XP/2003 (because someone still has Vista for some reason). The second is the fact companies take ages to release updates on their computers. My school, for example, has hundreds of Win7 Pro computers. They all haven't been updated since November 2016 (and today I'll go look if they have MS13-010)

[@xylan9543]

That moment when you hack your own computer cause you want to erase your trash memes

[@NOVA-en4ci]

The trash memes were still funnier than most new popular memes nowadays though. *cough cough ugandan knuckles cough cough*

[@PimpMatt0]

Feels like the 90s again with these viruses.

[@OneCarLowe]

Explicit Tech yep

[@GodzillaKaijuGK]

and early 2000s

[@jimbob20051]

*opens Rich Text Document and reads* "it's rich af" that has killed me XD

[@S-D-A99]

so Windows 10 can get this Virus?..... Woah, technology

[@Mykoo]

Miley Fox Im pretty sure you can get in any version of Windows if youre opening a .exe file, however, but dont quote me on this, if you have Windows 10 with your firewall enabled and anti-virus running + all the recent updates from Microsoft, you can't get infected through the network.

[@OMspot2277]

only if you didn't update windows 10 with that March update. But if you did then you were safe

[@dirtkiller23]

Auto Windows Updates.This is the only case where it helps.

[@vwestlife]

People on MSFN are saying that it is impossible for WannaCry to infect a system running from a FAT32 partition, because it relies upon NTFS to encrypt the files. Can you verify this?

[@chessemchesse3676]

Hi vvestlife

[@ninelivesbobcat3619]

*hears that Microsoft patched Windows XP* Does this mean Windows XP is back? YAAAA-- *realises that's it only to prevent the ransomware and that Windows XP will never be supported ever again* Ohhhhh. ;_;

[@boofcario]

Solution: Keep making ransomware that exploits XP. Support forever :D

[@archived527]

Who knows, there is a possibility that one of the patches could be ported to XP again if another serious attack like this happens. There was another post EOL patch in May 2014.

[@computethisinfo]

NinelivesBobcat I ran windows XP pro in a virtual machine yesterday, and was soo shocked to find people actually playing the internet Microsoft games so frequently finding someone instantly. why was I shocked? so many people still use XP. even though the internet browser was buggered and wouldn't open any https links and not load others.

[@anasarkawi4331]

windows xp is the king os oses!

[@TexelGuy]

Dang crybabies, suck it up and update. You're missing out on basically everything.

[@Fnmods]

Old days

[@springer1985]

Someone I knew lost very important information worth a lot of money. They had this same virus, paid the $300 in bitcoin and got everything back and the scammers were actually very friendly to work with which was odd.

[@Pokycraftgamer9]

you know when something is serious if Microsoft updated Windows XP

[@bugfriendz]

i got infected with wannacrypt when i was younger, kind of terrifying!

[@melonstuff9creative]

Were you using virtual machine?

[@bugfriendz]

@@melonstuff9creative no. real infection

[@TakoyakiDonuts]

WannaCrypt actually hit my local hospital, funny how it was the only one in the Greater Toronto Area to be hit.

[@DMack6464]

When I saw the headlines, I instantly thought "danoct1"

[@kairaus]

you know shit gets real when an update for windows xp is released

[@vzangel]

What happens with the already encrypted files if it's executed again? Does it encrypt them again or leaves them alone based on the file extension? If the latter happens, very important files could be protected by changing the file extension in anticipation.

[@zerozerito14]

Was waiting for this video, thanks :D !!!

[@TheKingBJ]

>shows a malware that asks for money to recover your files >outro plays a 8bit klezmer song oy vey

[@thetrashman5381]

You know a ransom ware is bad when Dan's video is trending

[@HiyaItsHailey]

You should've pulled a rogueamp and just posted a video of you driving in your 129° car.

[@RavenousRabbler]

"What up guys, RogueAmp here, today I heard that the worst malware attack since Conficker has finally happened. Because ransomware is totally not my specialty, I'm just gonna drive in my car and blast some E U R O B E A T"

[@piloticle2445]

DANOOCT IS ON TRENDING. never thought i'd see the day my dudes

[@Ranged66]

There's this interesting tool called Ransomfree, cold you consider testing it at some point with this malware to see if it works? It basically places bait files all around your computer and when it detects a ransomware messing with it it will try and stop it.

[@FIXTREME]

That Atari-esque Hava Naguila is nectar to my ears!🐱

[@Rctive]

for about 2 seconds when you were typing that message you sounded like joel

[@yourbuddymuddy]

holy shit this is the earliest ive ever been to a video ever

[@ki9980]

Muddy Bear ikr

[@VreyIsGrey]

You're not late. You're on time.

[@stevegamer68]

Imagine if the scammers accidentally encrypted their computers

[@ChanceOfOne344254]

This has actually happened allegedly, but not with this ransomware Allegedly, the author of Rensenware, had to complete his own task (score 2 billion points on lunatic mode in TouHou) in order to decrypt his own files due to forgetting to run the program in a virtual machine.

[@RMED24]

​@@ChanceOfOne344254that's partially false actually. What really happened is that he did encrypt his files, so he used cheat engine to force the score required to unlock the files. He then developed a tool which did all this automatically for those who were affected by rensenware

[@RonLaws]

what a fun year this was at work. Having Non-windows based NAS Servers with volume level snapshots was a saving grace :D

[@iyok050106]

my school alerted about this worm spreading and told everyone to not turn on their computer today and tomorrow, but screw it, I'm using a Mac! :p

[@fr0sth4x0r]

Great video, been following for about 3 years and this is hilarious

[@lordofwolve]

Good job NSA you provided me with the stuff to make people's lives worse. Thanks again

[@Dnk-fs8ks]

I was looking for this video. Thanks Dan

[@connorhare9359]

when u want kids but she not ready O O O P S

[@ismailabdullah4556]

My heart went- Oops! Your files have been encrypted!🤫

[@anentityshroudedinmystery.8037]

mushroom_chicken.docx Why did I type this comment

[@WackyH]

muchrom chickem

[@harmonicposting]

@@WackyH HOW

[@klaasbousma7013]

the news here in the Netherlands are just talking about this virus every time, and i was waiting for this video. now it's here. i love your content. it's really impressive and interesting to watch. keep it up

[@codex4336]

Does disabling the SMB feature in Windows keeps you safe from this computer worm?

[@yannisvill6806]

Danooct1 is back!!! So many memories :')

[@DiamondTurtleGamer]

I just realized how you don't kill your computer every time you do these videos.. virtual machine.

[@XJLuxury]

yes ive been waiting for this video! ive checked your profile every day since this came out

[@realcomputerdude100]

greetz from @danooct1 ya boi wit da malware yoooooooooooooooooooooooooooooooooooooooooooooooooooooooo

[@GreatJobStudio]

You're on trending, my guy! Gratz.

[@captainmexico5483]

I didnt watch all the video yet but the unlock code to the virus is " WNcry@2ol7 " thumbs up to let everyone know

[@DMack6464]

How did you find it?

[@raymond2136]

fr? well shit lol

[@the_lava_wielder6996]

I'm pretty sure it's randomized for each user

[@MatrixJ21]

It is. The key is sent from the program to an external server on execution of the payload, then removed from storage (and/or memory) on the target computer.

[@nyanezt9636]

"WannaCryAt2017"... huh

[@cargopros8246]

Yes I wanna crypt, thank you for asking.

[@hippiemcfake6364]

Awwww i wished you'd demonstrate the 'decrypt' button. It says that you can decrypt some files for free.

[@LOLMAN9538]

Thank God I try to keep both of my computers updated

[@quatex.854]

lol i got "BEST FREE ANTIVIRUS" ad more like BEST TROYAN VIRUS amiright?

[@DaniPaunov]

I saw the exact same Ransomware on TV literally 2 days ago (Saturday)

[@cisjik]

Finally, MS who abandon Windows XP upload the second update for Windows XPIt's seem Bill know a lot of people use Windows XP

[@fast_odin]

I have a question. If you were to have a text document in wichi you exactly know the text inside it. If it lets you see that encryoted message. Could you reverse engineer the encryption method? Or is it still incalculable?

[@nikolatesla6992]

2.0 is going to be released shortly with no kill switch (Verified) The internet will be gone before the end of the year. Nokia bricks will be back in style as soon as data goes bye bye. Welcome to 1984, get comfy.

[@xbotscythe]

Hello from the future.

[@faaznoushad1718]

@@xbotscythe give me the overview of your world

[@Canleaf08]

It hit companies that hard, that the Deutsche Bahn couldn't display any train information on the digital signages for a couple of days...

[@zacksstuff]

That's ballsy. Running it on your own computer. Even with a VM, that's risky.

[@AWISECROW]

likely running it on an expendable system.

[@ItsKardamin]

Congrats on getting on the top video list! Thank you for showing this one

[@Dragnerve.]

the key is WNcry@2o17

[@fastlane250]

My workplace got hit with something like this a few years back, there were a few weeks where we came in and basically got paid to sit around and do nothing because all our systems were screwed.

[@TubercomiMalwares]

I ransomware after i read abt the wncry ransomware attax!

[@crazyfatefan]

It's still active. Also even though it got halted by a 21 year old in Britan people say all the hackers have to do is rewrite the code and it can hit again. Most likely we will see more of wannacry or more ransomeware in general because of this, not to mention both microsoft and the NSA are now fighting each other because wannacry was the NSA's cyber weapon pet and now it's gone rogue. Who's to blame for this really? Who knows some say it's both Microsoft and the NAS's fault others are one sided and a few of my friends are saying "well shit happens, no one is impenetrable to getting hacked. They can have the best defense and protection but if one weakness is found and it wasn't notice..well to bad, hackers win. We will never know who will be blamed and what will happen to prevent something like this from happening again, only time will tell.

[@butth0le_inspector]

Legend says he found out one more thing about the virus

[@MagikGimp]

It's a 3 and a half meg file for god's sake. How could anyone mistake it for some stupid Word document about Mrs Noggins' gynaecology results or whatever?

[@RavenousRabbler]

My computing reports are Word documents that can get over 10 MB in size frequently.

[@MagikGimp]

Well if you do insist on embedding that many images... Word processors were never meant to be used as they are today. It's frankly an insult to the early software that they're so "abused" nowadays. Correct layout procedures and vector graphics only should be how it's done but will people listen to me? Will they heck. #oldpedant

[@FalbereChan]

this malware spreads not just by clicking an exe, also via networks. it is possible that a user did not have to peform any action and get hit with this.

[@kjl3080]

MagikGimp r/iamverysmart

[@foofin25]

Hell yea, danooct got trending.

[@fredfred1247]

Oops! This comment has been encrypted! Send a 3 replies and I will edit this comment so you can see what I wanna say.

[@MinusNC]

FRED FRED124 decryptor.exe

[@MinusNC]

FRED FRED124 backupdecrypt.exe

[@MinusNC]

FRED FRED124 Anti-Encryptor.exe

[@Bandecki]

1:16 - subtle girlfriend shoutout! haha, seriously though, good video, been waiting for this! :)

[@PsychoFizz]

lol subtle as a brick through a window isnt it?? ;)

[@MrWaffleSlapper]

>jew music for the patreon supporters shoutout HAHAHAHA

[@kieran7378]

I've been waiting for this.

[@patrickdunay39]

good to know that danooct1 has a gf 1:14

[@PsychoFizz]

lol yup thats me =)

[@tact1calbanana388]

PsychoFizz no daz me

[@PsychoFizz]

no sir.

[@arkadiuszbrzoza8886]

SKILLZ SKILLZ she didn't ransomware

[@okdev5420]

holy shit #20 on Trending GOOD JOB danooct!

[@hattyuu]

Wow *100* likes *1* dislike and im going to make a restore point & a backup cuz im programming in batch and i have a lot of progress.. ^^

[@Skylarr]

... restore points aren't gonna help you man, you need a full 100% copy onto an external drive

[@hattyuu]

+Docter Redstone Thankx

[@Architector_4]

+MatykeX And then you need to disconnect external drive and put it somewhere else DISCONNECTED.

[@sharath9893]

finally! i was eagerly waiting for this!

[@marioluigifun]

12:50 AM notification squad what up

[@444tuneski]

at home

[@chippitigameing]

"but you have not so enough time." -WannaCry, 2017

[@GhostRecon141]

wow cant believe you would rip off the homie rogueamp how could you do this to your old squad my dude?

[@firebucket8203]

Congrats on making it on trending Dan !!!

[@adriantarver2229]

Besides general online safety practices, disabling networking protocols you don't use could help significantly stop the spreading of Wana Crypt0r. Wana Crypt0r uses the SMB protocol, which is a file sharing protocol, and here is how you can disable it in powershell. Please spread the news. In Windows 10, their should be a search bar at the bottom left corner, search: powershell Click it, and then type out EXACTLY what you see below into the small blue powershell window. This will prevent Eternal Blue which is the exploit payload that basically spreads the ransomware across your internal network. You have to run both of these commands on every Windows computer on your internal network if you want to make sure it won't be infected by another computer on the same internal network that may already have the Wana Crypt0r ransomware. Set-SmbServerConfiguration -EnableSMB1Protocol $false Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters" SMB1 -Type DWORD -Value 0 -Force I tried my best to sum it up for the casual user here, so please don't hit me up with a million questions. lol I'm @Th3Tr1ckst3r

[@Brorrowind]

Should have mentioned the part where part of this was made possible because of the NSA's incompetence LOL