Aliases: WORM_WCRY.A (Trend Micro) Ransom_WCRY.I (Trend Micro) Trojan.Ransom.WannaCryptor.H (BitDefender) Trojan/Win32.WannaCryptor (AhnLab) Ransom.Wannacry (Symantec) Trojan-Ransom.WannaCry (Ikarus) Win32/Exploit.CVE-2017-0147.A trojan (ESET) Win32/Filecoder.WannaCryptor.D trojan (ESET) Ransom-O (McAfee) Troj/Ransom-EMG (Sophos) Trojan horse FileCryptor.OYP (AVG) W32/Wanna.D!tr (Fortinet) WannaCry (other)
Windows Defender AV detects and removes this threat.
This ransomware can stop you from using your PC or accessing your data. Unlike other ransomware, however, this threat has worm capabilities. It uses an exploit code for a patched SMB vulnerability, CVE-2017-0145. This vulnerability was fixed in security bulletin MS17-010, which was released on March 14, 2017. We remind all customers to keep computers up-to-date.
The exploit code used by this threat to spread to other computers was designed to work only against unpatched Windows 7 and Windows Server 2008 (or earlier OS) systems. The exploit does not affect Windows 10 PCs.
For more information about this ransomware (which is also known as WannaCrypt, WannaCry, WanaCrypt0r, WCrypt, or WCRY), you can read the following entries on the Windows Security blog and Microsoft Security Response Center:
Our ransomware FAQ page has more information on this type of threat.
The trend towards increasingly sophisticated malware behavior, highlighted by the use of exploits and other attack vectors, makes older platforms so much more susceptible to ransomware attacks. From June to November 2017, Windows 7 devices were 3.4 times more likely to encounter ransomware compared to Windows 10 devices.
There is no one-size-fits-all response if you have been victimized by ransomware. There is no guarantee that paying the ransom will give you access to your files.
If you've already paid, see our ransomware page for help on what to do now.
Use the following free Microsoft software to detect and remove this threat:
You should also run a full scan. A full scan might find hidden malware.
Use cloud protection to help guard against the latest malware threats. It’s turned on by default for Microsoft Security Essentials and Windows Defender for Windows 10.
To check if it's running, go to All settings > Update & security > Windows Defender and make sure that your Cloud-based Protection settings is turned On.
Download localized language security updates: Windows Server 2003 SP2 x64, Windows Server 2003 SP2 x86, Windows XP SP2 x64, Windows XP SP3 x86, Windows XP Embedded SP3 x86, Windows 8 x86, Windows 8 x64
MS17-010 Security Update: https://technet.microsoft.com/en-us/library/security/ms17-010.aspx
Customer guidance for WannaCrypt attacks: https://blogs.technet.microsoft.com/msrc/2017/05/12/customer-guidance-for-wannacrypt-attacks/
General information on ransomware: https://www.microsoft.com/en-us/security/portal/mmpc/shared/ransomware.aspx