What is 'WannaCry' ransomware

By now you must have heard of 'WannaCry' ransomware. The impact is massive where it attacked on 150 countries and around 200,000 users worldwide. I felt it necessary to provide the information and how to prevent such attacks in future.

Ransomware is the word that indicates to ransom. In a nut shell the intention is to make the user pay to get back the files. WannaCray can come into your system through email attachments and Microsoft SMB feature that is used for file sharing. It encrypts the file located on your desktop and all the drives. So file will have unknown icon with strange extension. After it locks files successful, leaves a message that to make the payment to get back their files.

If you have backup of  all files formatting the system is good option. But users who are not very much used to computers tend to fell for it. I would want to make the awareness among them to follow precautions to protect their system from such incidents in future.

1. Update Windows OS with Microsoft Security Bulletin MS17-010 from here.
2. Update Anti Virus.
3. Uninstall SMBv1 if not require.
4. Never Open unknown email attachment and mark such emails as junk or fishing.
5. Never click on unknown link, it may have executable which will run in the background.

Other preventive measures
1. Download software from vendor's website. For ex. if you want to download a Microsoft software it is recommended to get it from Microsoft sites.
2. Scan the system whenever any suspicious act observed.
3. Scan the USB drives before accessing them.
4. Prefer firewall enabled router and do not turn off windows firewall.

The incidents specifically happened with those OS which are no more supported by Microsoft like XP, Vista.

Stuck on Running State - TaskScheduler to run Powershell Script

Powershell can be used to automate tasks. Where you run three-four powershell files one after one and need to run the first script through task scheduler. Task goes into running state and not coming back to ready state. When you see the error it says one of its intsance is already running.

I came to this situation when  I was trying to run a sequence of multiple ps1 files one after one. I had created a batch file to run first script. It will check certain program status, if its not running it just restart the ps1 script sequence from beginning. In batch file I had only mention the single ps1 script file path and other scripts are triggered after every script. The task scheduler was stuck to Running state where it was not able to exit the batch file window. Thus it would not proceed the next script. Then I started searching on how to get rid of running state after it runs the batch file.

I do not know how you understand my scenario. But the question is How to exit the 'Running' state after running the batch file. You will not believe, you just need to type Start before Powershell script command inside batch file. It all worked well after changing the command. Task scheduler never went to Running after this change. The Batchfile commands were looking like below in the end.

@echo off
setlocal EnableExtensions DisableDelayedExpansion
CD "C:\Program Files\ProgramFolder"
TASKLIST | FINDSTR ProgramName > NUL 2> NUL
IF %ERRORLEVEL%==1 (

taskkill /F /IM Powershell.exe

Start PowerShell.exe -NoExit -file "c:\XXX.ps1"

)

endlocal
Exit

You may find this helpful with your complex scripting.