WannaCrypt0r Ransomware: How to Protect Yourself

Updated 8 November 2026 · Standard formula, shown below

WannaCrypt0r, also known as WannaCry, is ransomware that encrypts files and can spread between vulnerable Windows computers on a network. These steps reduce the chance of infection, limit its spread, and help you recover safely if a device is affected. You’ll need access to your computer’s update settings and a separate backup location.

What You’ll Need

An administrator account on each Windows computer you manage.
A reliable internet connection for security updates.
A backup drive or reputable cloud storage that is not continuously writable from your computer.
Contact information for your IT administrator, if this is a work or school device.

Step-by-Step

Install Windows security updates. Open Settings and go to Windows Update (on some older Windows versions, use Update & Security). Check for updates, install available security updates, and restart when prompted. WannaCry exploited a Windows vulnerability addressed by Microsoft’s MS17-010 security update. Current, supported Windows versions receive security fixes through normal updates; do not rely on an old patch alone. If your computer runs an unsupported version, arrange an upgrade to a supported operating system or ask your organization’s IT team for a safe migration plan.
Confirm that updates completed. Return to Windows Update and check for updates again. If updates repeatedly fail, note the message and contact your administrator or device support. Avoid downloading patches from unofficial websites. An update that is merely downloaded but still awaiting installation may not protect the computer.
Turn on the built-in firewall. Open Windows Security, choose Firewall & network protection, and check that the firewall is on for the network profiles you use. A firewall helps block unwanted network connections, but it does not replace updates, backups, or careful handling of files. On a managed computer, do not change organization-wide firewall settings yourself.
Disable SMBv1 if it is not needed. WannaCry spread in part by exploiting vulnerable SMBv1 file-sharing services. On Windows, search for Turn Windows features on or off, open it, and clear SMB 1.0/CIFS File Sharing Support if it is enabled and your organization does not require it. Restart if Windows requests one. Some older devices or applications depend on SMBv1; check with IT before disabling it on a managed network. Prefer newer, supported file-sharing protocols and replace equipment that cannot use them.
Make a backup that ransomware cannot easily alter. Back up important files to a separate external drive, then disconnect that drive when the backup is complete. Alternatively, use a reputable cloud backup with version history or recovery features. Keep more than one copy of irreplaceable files where practical, and periodically check that you can restore a sample. A drive left connected and writable can be encrypted along with the computer.
Use everyday accounts carefully. Use a standard (non-administrator) account for routine work where practical, and approve administrator prompts only when you understand why they appear. Keep security software active and updated. Don’t open unexpected attachments or links, even if they appear to come from someone you know; confirm unusual requests through a separate, trusted channel.
Protect shared networks. Make sure every computer on a home or workplace network is updated, not just the one you use most. Remove or isolate obsolete computers that cannot be secured, and ask IT to review file-sharing access and network segmentation. Avoid connecting an infected or suspicious device to shared drives or other computers.
Know what to do if infection is suspected. If files suddenly become inaccessible or a ransom message appears, disconnect the device from Wi-Fi and unplug its network cable. Do not connect backup drives. Tell your IT or security team promptly. For a personal computer, seek help from a reputable incident-response or computer support professional. Preserve the message and relevant details, but do not try random “decryptor” downloads or pay based on a promise of recovery.
Restore only after the device is safe. Have the affected computer assessed and cleaned or reinstall its operating system from trusted installation media before restoring files. Restore from a backup known to predate the infection, and scan restored data with updated security software. If the computer belongs to an organization, let its IT team direct this process; reconnecting an infected machine can spread the attack again.

Common Mistakes

Assuming antivirus alone is enough. Security software helps, but unpatched systems and exposed file-sharing services remain risks.
Leaving the backup disk attached. Ransomware may reach any connected, writable storage. Disconnect removable backups when finished.
Disabling SMBv1 without checking dependencies. This can interrupt older applications or devices. Confirm requirements with IT and plan replacements where necessary.
Thinking one patched computer protects the whole network. Each vulnerable device can be a route for infection. Update all computers and address unsupported systems.
Paying or installing tools in a rush. Payment does not guarantee file recovery, and untrusted tools may cause further harm. Isolate the device and get qualified help.

Tips

Turn on automatic security updates, and restart promptly when an update requires it.
Use a backup schedule that covers new and changed files; test restoration rather than assuming a backup works.
Keep a written list of important devices and who is responsible for updating them.
For work devices, report suspicious activity immediately instead of investigating on a shared network.
Be cautious with unexpected documents, macros, links, and requests to enable content.

Troubleshooting

Windows Update will not install: Restart and check again, make sure the device has a stable internet connection and sufficient free storage, and use the built-in Windows Update troubleshooter if available in your settings. If the computer is unsupported or the problem persists, contact IT or a qualified technician rather than using unofficial update files.

You cannot find the SMBv1 option: Windows editions and configurations differ. Do not assume the feature is absent or enabled; ask IT to verify the computer’s SMB configuration. Avoid changing registry settings or running commands you do not understand.

A backup is missing or cannot be restored: Check the backup service’s recovery or version-history interface from a clean device. Do not attach a backup disk to a computer that may be infected. If the data is important, seek professional advice before attempting repairs that might overwrite recoverable files.

You see a ransom note or files are changing names: Disconnect the device from networks immediately and leave backups disconnected. Contact your organization’s security team or a reputable professional. Do not reboot or delete files unless responders advise you; preserving evidence can help diagnosis and recovery.

Frequently Asked Questions

Is WannaCrypt0r the same as WannaCry?
WannaCrypt0r is a name associated with the WannaCry ransomware outbreak. The attack encrypted files and could spread across networks by exploiting vulnerable Windows systems.

Does installing updates guarantee I cannot get ransomware?
No. Updates close known vulnerabilities, including the one exploited by WannaCry, but phishing, other software flaws, and stolen credentials can still put systems at risk. Combine updates with backups and cautious security practices.

Should I pay the ransom?
Payment does not guarantee that files will be restored and may encourage further attacks. Isolate the device and consult your IT or security team or a reputable incident-response professional.

Can I recover encrypted files without paying?
Possibly, if you have an unaffected backup or a recovery method applicable to your specific infection. Do not assume a tool works for every case; get expert advice and avoid untrusted downloads.

What if I use an old version of Windows?
Check whether it is still supported and receiving security updates. If not, plan to move to a supported version. If an upgrade is not immediately possible, disconnect it from networks where practical and ask a qualified administrator about risk reduction.

Are cloud backups automatically safe from ransomware?
Not always. Synced files can sometimes reflect encrypted changes. Choose a backup service with version history or recovery options, secure the account, and test restoring files.

Method: the standard formula for this calculation, rounded as each result states. See how the calculators work or report an error.