Unsolved
This post is more than 5 years old
1.1K Posts
0
1395
WannaCrypt vulnerability in Win 10
Hello
I have Win 10 Pro installed and keep up to date with all the latest updates.
1. Would having sandbox (Sandboxie) as additional layer of protection, has any merits in prevention from above such attack?
Or one will have to have paid version of the MBAM?
I did a scan after updating to the latest version with Home unpaid edition of the Mal warebytes Anti-Malware Home (free) 2.2.1.1043 this morning. An item was quarantined : "Trojan.Ertfor 14/05/2017 07:47 File .....\name.STUDYROOM\AppData\Local\Temp\Login.exe.
Is this ^^ above anything to do with the recent world wide causing infestation?
2. I read it on some site about having "firewall", I would have thought the Win 10 on instalment have it's firewall activated automatic- A bit confused by the above statement.
My virus protection is the one dispatched (bundled) with Win 10 Pro. ( This is just a statement)
In addition to prudent behaviour in when opening emails attachments, visiting web sites with caution...ect what else one could do!!
ky331
3 Apprentice
3 Apprentice
•
15.3K Posts
2
May 14th, 2017 05:00
According to Microsoft, as long as your Win10 system downloaded/installed Microsoft Security Bulletin MS17-010 - Critical Security Update for Microsoft Windows SMB Server (which was released in March), you should be protected from this particular (WannaCrypt) attack. https://technet.microsoft.com/en-us/library/security/ms17-010.aspx
You mentioned that your "virus protection is the one dispatched (bundled) with Win 10 Pro." I take that to mean Windows Defender. For customers using Windows Defender, Microsoft released an update on 12 May which detects this threat as Ransom:Win32/WannaCrypt.
You certainly should have some firewall running... the one included in Win10 is fine.
====================================
Additional programs also claim to prevent ransom-ware (in general), some citing WannaCrypt in particular. MalwareBytes paid/pro is one such program. However, given their current pricing plan (annually renewable license), and all the problems people are reporting in their forum about the 3.x version, I cannot in good faith advocate anyone purchasing this program now. I have a "lifetime" license on one system, which they (hopefully) have "grand-fathered"... but I am still using v2.x on that system.
A FREE program targeting ransom-ware is CryptoPrevent, https://www.foolishit.com/cryptoprevent-malware-prevention/ . I still have version 7.x installed on my systems... version 8 is available from the link I just cited. I'm not sure if the free version protects against WannaCrypt... but the paid version (allegedly) does.
====================================
As for Sandboxie, since it "restricts and blocks internet websites and programs from accessing your personal data (i.e. My Documents), files & folders on your system", that theoretically SHOULD protect you against ransom-ware, and so it's prudent to use regularly. I've not read anything specifically about Sandboxie and WannaCrypt.
snowshine
1.1K Posts
0
May 14th, 2017 06:00
Helpful as ever. Thank you
My system working fine not affected (as yet) by the above. I hope I don't get in this trap!!
Regards
joe53
5.8K Posts
0
May 14th, 2017 12:00
I wondered exactly the same question. Especially since Woody subsequently includes a link in that article on how to patch XP against WannaCrypt.
Go figure ...
ky331
3 Apprentice
3 Apprentice
•
15.3K Posts
0
May 14th, 2017 12:00
One point of Woody's article puzzles me: he starts by explicitly writing that "WannaCrypt does not infect XP machines". If so, then why did Microsoft take the extraordinary move of releasing an emergency XP patch for the general public? Something is off between these two antithetical viewpoints.
joe53
5.8K Posts
0
May 14th, 2017 12:00
Windows 10 appears not to have been targeted by this particular version of WannaCrypt. All Windows 10 security updates are installed automatically, so the March patch would have been installed. To quote MS:
"The exploit code used by WannaCrypt was designed to work only against unpatched Windows 7 and Windows Server 2008 (or earlier OS) systems, so Windows 10 PCs are not affected by this attack."
For users of other Windows OSs, Woody Leonhard has the best detailed summary I've seen (posted on May 13th) on how to determine if your Windows OS is patched (it should be if you use Windows Update religiously):
www.askwoody.com/.../