MS17-010

WannaCry Ransomware: EternalBlue SMB Exploit Fix & Recovery

EP
Erropedia Team
📅 September 26, 2026 📅 Updated Sep 26, 2026 👁 3 views Cybersecurity & Malware Intermediate
WannaCry hit in May 2017, encrypting files and showing a $300 Bitcoin demand. Here's how to stop MS17-010 and recover.

It's 9 AM on a Monday. You walk into the office, and half the computers are showing a red screen with a countdown timer. Files have been renamed with .WNCRY extensions. A demand for $300 in Bitcoin appears. You've just become a WannaCry victim.

This isn't a drill. In May 2017, WannaCry infected over 200,000 computers in 150 countries within a single day. The attack hit hospitals, banks, and businesses. The trigger? An unpatched Windows system with SMBv1 enabled. The worm spread through the EternalBlue exploit, which targeted a vulnerability in Microsoft's Server Message Block protocol.

If you're seeing the WannaCry ransom note, don't pay. The real fix is patching the vulnerability and cleaning the system. Here's how.

Why EternalBlue Works

EternalBlue exploits a flaw in how Windows handles SMBv1 packets. Microsoft patched it in March 2017 with MS17-010, but many systems weren't updated. The exploit lets an attacker execute code remotely without authentication. Once inside, WannaCry encrypts files and spreads to other machines on the network.

This isn't about weak passwords. It's about a protocol that should have been disabled years ago. SMBv1 is outdated and dangerous. The fix is simple: patch and disable.

Step-by-Step Fix

  1. Disconnect from the network immediately. Pull the Ethernet cable or disable Wi-Fi. This stops the worm from spreading to other devices. Don't shut down yet — you might lose forensic data, but if the encryption is ongoing, powering off can prevent further damage.
  2. Apply the MS17-010 patch. If you can still boot into Windows, download and install the update for your OS version. For Windows 7 SP1, it's KB4012212. For Windows 8.1, KB4012213. For Windows 10, KB4013429. If you can't get online, use another computer to download from Microsoft's Update Catalog, then transfer via USB.
  3. Disable SMBv1. Open PowerShell as admin and run: 
    Set-SmbServerConfiguration -EnableSMB1Protocol $false -Force
    For older systems, go to Control Panel > Programs > Turn Windows features on or off > uncheck SMB 1.0/CIFS File Sharing Support. Reboot.
  4. Block port 445. On your firewall, block inbound and outbound TCP port 445. This prevents SMB traffic from leaving or entering your network. If you're on a home router, check for a setting to disable file sharing or block SMB.
  5. Run a reputable removal tool. WannaCry doesn't have a kill switch, but tools like Malwarebytes or Windows Defender Offline can remove the dropper. Boot into Safe Mode with Networking, then scan. Note: this won't decrypt files, but it stops reinfection.
  6. Restore from backup. If you have a clean backup from before the infection, restore it. Check that the backup isn't connected to the infected machine. Use a separate drive or cloud service that wasn't mapped.
  7. Change all passwords. After cleaning, change passwords for all accounts, especially admin accounts. WannaCry can steal credentials. Use a password manager and enable two-factor authentication where possible.

If It Still Fails

If the system won't boot or the patch won't install, you might have a variant that blocks updates. In that case, use a bootable rescue disk like Kaspersky Rescue Disk or Windows Defender Offline to scan outside the OS. If files are encrypted and you have no backup, check for decryptors. For WannaCry, there's no public decryptor because the encryption is strong. Some older variants had flaws, but the main one doesn't. Your best bet is to wipe and reinstall, then restore from a known good backup.

Also check your network for other vulnerable machines. Use a vulnerability scanner like Nessus or OpenVAS to find unpatched systems. The worm can linger on network shares. Disable file sharing if you don't need it.

Finally, if you're on Windows XP or Server 2003, Microsoft released an emergency patch (KB4012598). Install it even though support ended. And for the love of all things holy, get off SMBv1. It's 2024. There's no excuse.

WannaCry was a wake-up call. The patch existed for two months before the outbreak. Don't be the next statistic.
Related Errors in Cybersecurity & Malware
Removing ransomware that encrypts files and demands Bitcoin Unauthorized API Access Attempt — The Real Fix TLS Cipher Mismatch TLS Cipher Mismatch Detected: Quick Fix Guide 0X80091010 Fix CRYPT_E_STREAM_MSG_NOT_READY (0x80091010) in Windows
WannaCry ransomware EternalBlue exploit SMB vulnerability MS17-010 patch ransomware removal decrypt WannaCry files Windows security update disable SMBv1 ransomware recovery cybersecurity attack EternalBlue fix WannaCry removal tool malware protection Windows update KB4012598 network security

Was this solution helpful?

EP
Erropedia Team
Tech Support Editors
The Erropedia editorial team researches and documents real-world tech errors from across Windows, Linux, macOS, networking, databases, cloud platforms, and more. Every solution is reviewed for accuracy and updated as software and systems evolve.