Windows 7 Forums

Welcome to Windows 7 Forums. Our forum is dedicated to helping you find support and solutions for any problems regarding your Windows 7 PC be it Dell, HP, Acer, Asus or a custom build. We also provide an extensive Windows 7 tutorial section that covers a wide range of tips and tricks.


Windows 7: (wannacry ransomware) disabling smb1, but cannot found it

14 May 2017   #1
stillw7

windows 7 64 bits
 
 
(wannacry ransomware) disabling smb1, but cannot found it

hello,
wannacry ransomware piracy brought me here.
So i want to disable smb1 as a proactive measure (i read many advices to do that).
However, i didn't found it in "start/control panels/programms/turn windows features on or off".
Here's my question ? Why smb1 doesn't appear here? Is this ok ? It's already disabled ?


stillw7 (and happy)
thanks for reading

laptop asus
windows 7 ultimate


My System SpecsSystem Spec
.
15 May 2017   #2
Alejandro85

Windows 7 Ultimate x64
 
 

Simply disabling the service will effectively remove the vulnerability, but at the cost of losing the ability to share folders, it's not the optimal choice at all.

The best course of action is to apply the security patch that fixes the bug and prevents the spread of the virus without disabling anything. You need to download KB4012212 and apply it to get rid of the vulnerability. You can download from the link or though Windows Update.

If you still want to disable SMBv1 altogether, go to start => type services.msc => find the "server" service, stop it and set it to disabled. It doesn't appear in the Windows features because SMBv1 isn't a feature, is a protocol, and the server service is what implements it.
My System SpecsSystem Spec
15 May 2017   #3
stillw7

windows 7 64 bits
 
 

Hey Aexandro85,

thank you so much for your reply.
It's crystal clear, easily understandable and helpful.
I read a lot of things on the internet, but always more complicate.
Problem solved.

My System SpecsSystem Spec
.

01 Jun 2017   #4
andynine

Windows 10 Pro
 
 

Quote   Quote: Originally Posted by Alejandro85 View Post
Simply disabling the service will effectively remove the vulnerability, but at the cost of losing the ability to share folders, it's not the optimal choice at all.

The best course of action is to apply the security patch that fixes the bug and prevents the spread of the virus without disabling anything. You need to download KB4012212 and apply it to get rid of the vulnerability. You can download from the link or though Windows Update.

If you still want to disable SMBv1 altogether, go to start => type services.msc => find the "server" service, stop it and set it to disabled. It doesn't appear in the Windows features because SMBv1 isn't a feature, is a protocol, and the server service is what implements it.
Sorry but I had to sign up just to respond to this as it's quite a way off the mark

I'll agree that installing the KB4012212 hotfix is definitely the best way to go

But in terms of your original question

Disabling the server service as advised above totally disables SMB and as also mentioned above it's correct that you'll lose the ability to share files

But there is no need for a measure that extreme

There are three "dialects" for SMB

The vulnerability applies to SMB1

SMB 2 and SMB3 are not affected

So as long as you have a version of Windows that supports the newer SMB versions you can disable SMB1 (basically anything higher than Windows XP and Windows Server 2003)

Microsoft has a comprehensive write up of how to do it here

https://support.microsoft.com/en-gb/...windows-server

It IS a feature that you can you enable/disable in Windows 8.1, Windows 10, Windows 2012 R2, and Windows Server 2016

For everything else it's a couple of commands or a registry entry

note you have the option for disabling SMB1 for;

the server (a computer where files are shared from)

the client (a computer used to access files on a server)

A windows machine can be both of these things so you have the option of disabling one or the other (i've done both on my networks)

Knock on effects to consider....
Some devices only use SMB 1 (photocopiers that do scan to folder, older NAS devices, etc)


Any questions feel free to ask...
My System SpecsSystem Spec
01 Jun 2017   #5
andynine

Windows 10 Pro
 
 

It's also worth noting...

Disabling SMB1 will not protect you from wannacry ransomware

This vulnerability is how wannacry spread so fast across big networks (such as the NHS)

Once it's on your PC (through traditional methods ransomware uses) it'll look for vulnerable SMB servers it can use to spread

If you've got a single PC then making this change won't protect your system any more than it was before (unless for some mad reason you've got your PC exposed directly to inbound traffic from the Internet...but you'd have bigger problems if that were the case!)
My System SpecsSystem Spec
01 Jun 2017   #6
samuria

win 8 32 bit
 
 

Most of the ransomware was company pcs as they scan for the problem and if they find an opening then it attacks on a home network it cant do that from the internet if your behind a nat router so a lot of home users were safe. If it got in from some other way then it would spread to home network
My System SpecsSystem Spec
01 Jun 2017   #7
andynine

Windows 10 Pro
 
 

Quote   Quote: Originally Posted by samuria View Post
If it got in from some other way then it would spread to home network
True.
But as I said if you've got a single PC then there is nowhere for it to spread to. Disabling SMB at that point won't make any difference at all
My System SpecsSystem Spec
Reply

 (wannacry ransomware) disabling smb1, but cannot found it




Thread Tools




Similar help and support threads
Thread Forum
HDD not found in Windows Installation but found in BIOS
So it's a long story. I hadn't had Microsoft Net Framework on, so I turned it on. Then my PC randomly crashed. Tried to reboot but it got stuck in the crash then reboot circle. I tried my hardest to fix it but I couldn't find anything to fix it so I decided to just, reinstall windows. I made...
Hardware & Devices
USB disc not found at boot but is found when restarted
Hello all, I've had this issue for quite some time now, it never really bothered me that much, but it is annoying, so I thought I'd give it a shot to see if anyone could help me out. I've got 2 external USB drives, one on 2 Gb and one on 4 Gb. the 2Gb drive is no issues at all. Works...
Hardware & Devices
Homegroup not working, server unable to start smb1/2 issue
Hi after cloning a disk with bad sectors (having fixed them all) Boy was I lucky! I have run into an unusual issue. Everyting works great except homegroup. I can't leave it or see the password. Server in services is not started and when I try and start it, I get a dependancy error . Checking the...
Network & Sharing
Lost Pwr During Defrag - FOUND folder not found
Last night was using Auslogics to defrag an external WD 1.5TB BU drive... 2 hours in we had a power loss...lights and TV went out and came back on. The laptop that was running the Auslogics had a batt, but the external drive lost power in the middle of the defrag process. Turned everything off for...
Performance & Maintenance
operating system not found and no drivers were found eror
as usual I turned off my laptop and after a while a turned on again to use my laptop but it couldn't reach operating system and showed error : " OPERATING SYSTEM NOT FOUND" ! I tried all instructions to solve the problem and finally run by windows start up CD to re-install new windows. this...
Installation & Setup


Our Sites

Site Links

About Us

Find Us

Windows 7 Forums is an independent web site and has not been authorized, sponsored, or otherwise approved by Microsoft Corporation. "Windows 7" and related materials are trademarks of Microsoft Corp.

Designer Media Ltd

All times are GMT -5. The time now is 00:37.
Twitter Facebook Google+ Seven Forums iOS App Seven Forums Android App