WannaCry .WNCRY Files: Kill EternalBlue Fast

1. The Real Culprit: SMBv1 and the Missing MS17-010 Patch

I know this error is infuriating. One minute you're working, the next your files have a .WNCRY extension and a ransom note demanding Bitcoin. The root cause is almost always the same: your Windows machine is still running SMBv1 and never got the MS17-010 patch from March 2017. That's the EternalBlue exploit WannaCry rides in on.

Here's the thing: WannaCry spreads like a worm. It scans port 445 (SMB) on your network, and if it finds an unpatched system, it drops the payload without you clicking anything. This tripped me up the first time too—people think ransomware only comes from email attachments. Not this one.

Fix It Now: Patch and Disable SMBv1

If you're lucky enough to catch this before the encryption finishes, or if you're cleaning up after an infection, do this immediately. On Windows 10 (all versions) and Windows Server 2016, you can disable SMBv1 via PowerShell:

Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters" -Name SMB1 -Type DWORD -Value 0

# Then disable the SMBv1 service
Disable-WindowsOptionalFeature -Online -FeatureName SMB1Protocol -NoRestart

For Windows 7 and Server 2008 R2 (still common in 2024), you need to manually remove SMBv1 via Control Panel:

1. Go to Control Panel > Programs > Turn Windows features on or off.
2. Uncheck SMB 1.0/CIFS File Sharing Support.
3. Click OK and restart.

Then install the actual patch. Microsoft released KB4012212 for Windows 7 and KB4012215 for Server 2008 R2. If you’re on Windows 10, KB4012606 or later cumulative updates cover it. Do not skip this—disabling SMBv1 helps, but the patch closes the underlying hole.

Pro tip: If you're in a corporate environment, push this via WSUS or SCCM. Manual patching misses machines, and one unpatched box can re-infect the whole network.

2. Not Patched Yet? Block Port 445 at the Firewall

Maybe you can't patch right now—legacy software, no maintenance window, whatever. I get it. But you can't leave port 445 exposed. EternalBlue needs that port. Block it at the Windows firewall and your router.

On the Windows machine itself, run this as Administrator:

netsh advfirewall firewall add rule dir=in action=block protocol=TCP localport=445 name="Block_SMB_445"

This creates a firewall rule that drops all inbound SMB traffic. If you're on a network with legitimate file sharing, this will disrupt it—but that's a small price compared to losing all your files.

Also, check your router's firewall settings. Many consumer routers have an option to "Disable WAN-side SMB" or simply block incoming TCP 445. If you're not sure, log into the router and look for "Port Forwarding" or "Firewall Rules". Add a rule that blocks 445 from any external source.

A specific scenario I've seen: A small business had a Windows 7 machine running an old ERP system. They couldn't patch it because the ERP vendor went under. We blocked port 445 at the router and on the machine itself. That stopped WannaCry cold. It's not a permanent fix, but it buys you time.

3. Already Infected? Stop the Spread and Recover Files

If you're reading this because you're already staring at .WNCRY files, here's the harsh truth: there's no official decryptor for WannaCry as of 2024. But don't give up—there are two practical paths.

Path A: Disconnect and Isolate Immediately

The worst thing you can do is leave the infected machine on the network. WannaCry scans for other vulnerable machines. Unplug the Ethernet cable or turn off Wi-Fi right now. Then boot into Safe Mode with Networking. Why safe mode? Sometimes the encryption process doesn't run, and you can grab some files before they're touched.

Copy your important files to an external drive that's not connected to the network. If you have recent backups, great—restore from those after you've cleaned the network.

Path B: Try the WannaCry Decryptor (For Windows XP and 7 Only)

Researchers found a flaw in the early WannaCry variants. If you're on Windows XP or Windows 7 with old SMBv1, you might get lucky. Download the WannaCry Decryptor from the No More Ransom project (nomoreransom.org). Run it on the infected machine and see if it can recover files. It won't work on Windows 10, so don't waste time there.

But honestly, if you're on Windows 10 and got hit, your best bet is backups. Check OneDrive, Google Drive, or any file history you have. I've seen people recover entire folders from shadow copies—if you have System Restore enabled, try vssadmin list shadows in an admin command prompt. If you see a shadow copy, you can copy files from it using copy \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy1\YourFile.docx C:\Recovered\.

Don't pay the ransom. There's no guarantee you'll get your files back, and you're funding the next attack. I've seen too many people pay and get nothing.

Quick-Reference Summary Table

Look, this whole thing is a nightmare. But the fix is a combination of hygiene and speed. Patch your systems, block that port, and keep offline backups. If you do that, WannaCry becomes a nuisance, not a catastrophe.