WannaCry

Barman58 · 18 May 2017

SMB is a protocol included in windows to work with devices that use this, what is now an older, protocol if you switch it off then any device that relies on it will not be visible on your Local network

Tonyb · 18 May 2017

Ugh that includes my brand new 4K smart tvs and my xbox one S OMG why they use a outdated protocol

Barman58 · 18 May 2017

It's not really outdated, but it has been updated at least twice, as SMB2 and SMB3 are both active. I think a lot of devices are using it due to an "if it ain't broke don't fix it" attitude, but the later versions are I think more secure so in one way it is broken. It's also I think still used in a lot of Linux distros which are then adapted for use as embedded controls for tv's etc.

Tonyb · 18 May 2017

how do i check for those other ones??

Barman58 · 18 May 2017

To be honest it's a little vague to say the least The SMB 1 protocol is depreciated in windows 10 but a lot of other devices still use it , as you have discovered

This gives the exact state (as of 2 years ago when Windows 10- was just being released) of what windows uses what ...

The Deprecation of SMB1 s Blog

All I can say is to not worry about it at the moment as most people will still need it - the best is to disable it temporarily and if it causes problems then re-enable it - If you have no issues (no other devices need it), then removing SMB 1 is a good idea - Anything else should be left alone as they are still active - All are now patched in Win 10 where needed so are safe, they will continue to be patched in future if need arises, so the standard advice is the same as always be careful what you click on, be careful where you surf to, and if an offer looks to be to good to be true it probably is

clam1952 · 18 May 2017

Tonyb said:

how do i check for those other ones??

SMB2 and 3 come as a pair if SMB2 is enabled, then so is SMB3.
To check run this in powershell.

Code:

Get-SmbServerConfiguration | Select EnableSMB1Protocol, EnableSMB2Protocol

Which gives you this.

Code:

Windows PowerShell
Copyright (C) 2016 Microsoft Corporation. All rights reserved.

PS C:\WINDOWS\system32> Get-SmbServerConfiguration | Select EnableSMB1Protocol, EnableSMB2Protocol

EnableSMB1Protocol EnableSMB2Protocol
------------------ ------------------
              True               True


PS C:\WINDOWS\system32>

Tonyb · 18 May 2017

Thanks for that they are on :)

simrick · 19 May 2017

Reposting this here, in case someone needs it:

So there's a possibility to get your encrypted files back...for some....
WannaDecrypt your files? The WannaCry solution, for some - Malwarebytes Labs | Malwarebytes Labs

The decryptor is only going to work if you haven’t restarted the infected system and you haven’t killed the ransomware process (should be wnry.exe or wcry.exe) so please don’t restart or kill the process if you want to get those files back!

doncole · 19 May 2017

Thanks Everybody for your replies,

I don't the have the virus now. I had it couple of years ago. Back then it was $500. I guess they lowered price because the newest one is $300.

I didn't send the B words nothing and never will.

Most of my important files are written in another language. The virus didn't effect those files. The files that where encrypted, I just wrote them off as deleted.

I don't know why the FBI, SEC, CIA or somebody can't prosecute the scammers. Included with the virus are the instructions as to where to send the money. This would be a good place to start the investigation.

I got another virus from a purposely corrupted USB stick.

I couldn't find it with AV but finally did with Kapersky.

I had Kaspersky at the time I got the WannaCry virus but had it turned while I was doing something I shouldn't. Once I turned it back on it found and removed the virus immediately. But did not decrypt the encrypted files.

Since that time I haven't got the virus again.

Steve C and simrick,

I can't find the Windows Features Window you show in your screen shots.

Sorry I was so late in replying.

Don Cole

Mystere · 19 May 2017

doncole said:

I don't the have the virus now. I had it couple of years ago. Back then it was $500. I guess they lowered price because the newest one is $300.

[...]

I don't know why the FBI, SEC, CIA or somebody can't prosecute the scammers. Included with the virus are the instructions as to where to send the money. This would be a good place to start the investigation.

Those were different malware, from different authors. WannaCry is a new one, based off new vulnerabilities.

They can't track them down easily because they're demanding Bitcoin transfers, which can't be tracked by traditional banking means, and are sent electronically.