Reply to thread

Message

<blockquote data-quote="Andy Ful" data-source="post: 630522" data-attributes="member: 32260">Hard_Configurator can also mitigates Wannacry with&nbsp; the option &lt;Disable Command Prompt&gt; = ON , because the malware uses cmd.exe to get persistence and delete the volume shadow copies.<a href="https://www.endgame.com/blog/wcrywanacry-ransomware-technical-analysis" target="_blank">WCry/WanaCry Ransomware Technical Analysis | Endgame</a>The attack can be stopped by &lt;Block Remote Access&gt; = ON, if the attacker tries to use Remote Shell or Remote Desktop.Edit1I corrected my post by removing the info about @WanaDecryptor@.exe - I am not convinced, if it is the encrypting executable.Edit2Home users can be infected by Wannacry by running the malware executable.Hard_Configurator with recommended settings (SRP + &lt;Run As SmartScreen&gt; = Administrator) will stop Wannacry execution by the user, due to forced SmartScreen.</blockquote>

[QUOTE="Andy Ful, post: 630522, member: 32260"] Hard_Configurator can also mitigates Wannacry with the option <Disable Command Prompt> = ON , because the malware uses cmd.exe to get persistence and delete the volume shadow copies. [URL='https://www.endgame.com/blog/wcrywanacry-ransomware-technical-analysis']WCry/WanaCry Ransomware Technical Analysis | Endgame[/URL] The attack can be stopped by <Block Remote Access> = ON, if the attacker tries to use Remote Shell or Remote Desktop. Edit1 I corrected my post by removing the info about @WanaDecryptor@.exe - I am not convinced, if it is the encrypting executable. Edit2 Home users can be infected by Wannacry by running the malware executable. [B]Hard_Configurator with recommended settings (SRP + <Run As SmartScreen> = Administrator) will stop Wannacry execution by the user, due to forced SmartScreen.[/B] [/QUOTE]

Verification