[Emergency Announcement] Encryption Ransomware Comes Off Quickly

From Friday, May 12, many institutions in the country (in fact, the world) suffered ransom from virus software. In fact, these things also happened in 2016, but only through the documents in the mail to the computer. Infection, but this time it is different, the situation is far beyond people's imagination.

To put it simply, this weekend’s incident was caused by lawbreakers using the “Eternal Blue” leaked from the NSA hacker's arsenal (hacking tool). It scans and opens up port 445 (for file sharing). System computer, none of the versions are spared. On computers that are under attack, all files will be encrypted by a virus with a high-intensity encryption algorithm. If your computer pops up the picture below, you are required to pay “bitcoin” (an internet virtual currency) to decrypt the file.

Or if all the file suffixes on the computer have been changed to .WNCRY, it is a real move.

The following are the key points, how to prevent! ! !

First, the speed of the installation of MS17-010 security update for Windows (this patch has been fixed system vulnerabilities), URL: https://technet.microsoft.com/zh-cn/library/security/MS17-010, please according to their own System version download patch, if you have updated to Windows 10 creators update, and always keep Windows Update open, basically can relax.

Second, if your computer is in the corporate intranet and campus network, speed shut down the 445, 135 ports of the Windows operating system (China Unicom, Telecom did not open 445 ports, broadband users can prohibit file sharing), the specific methods are as follows:

Windows 7~Windows 10 operating system

Start the command prompt in administrator mode and enter:

Netsh advfirewall set allprofile state on

Netsh advfirewall firewall add rule name=deny445 dir=in action=block protocol=TCP localport=445

After the carriage return, you can.

Windows XP operating system

Start the command prompt in administrator mode and enter:

Net stop rdr

Net stop srv

Net stop netbt

Third, it is not easy to click on unknown website links, e-mail attachments, download unknown files.

Fourth, important files off network backup.

5. Use the NSA arsenal immunization tool (download address: http://dl.360safe.com/nsa/nsatool.exe) to scan the files on the disk.

6. Using the technique described in “One second to prevent router vulnerabilities from relying on this trick”, select this setting in the DMZ option of the wireless router and point to an IP address without a device in the LAN. Or you can consider forwarding the three ports 139, 445, and 3389 to the IP address of the device that does not have the same LAN.

Finally, if the files in the computer are encrypted, the solution that Xiaobian can give is to completely format the hard disk, reinstall the Windows 10 operating system, and upgrade to the latest version. Do not rely on search engines to give "file decryption tools." It is understood that there is currently no tool that can decrypt encrypted files affected by the virus.

In addition, do not pay bitcoin ransom, because the face of offenders without the bottom line, the payment of ransom does not mean that everything can be returned to normal, and is also a regular thing to crack the vote, bite the teeth, it should buy yourself a lesson.