Skip to main content

How to protect your computer from the WannaMine malware

After the WannaCry ransomware, now we have the WannaMine malware. WannaMine is a fileless malware that infects Windows-based computers with the purpose of using the computer’s resources, such as CPU and RAM to mine a cryptocurrency called Moreno. Any coins mined will be transferred to the developers of this malware. It uses the same exploit developed by NSA, called EternalBlue that was used for the WannaCry ransomware.
Panda Security was the first to discover this malware several months ago. Both Sophos and Panda claim to protect against this malware, but you need to also ensure you're taking the necessary steps to protect your computer against this attack.
The way this malware works is it uses the SMB protocol on port 445 and sets a WMI permanent event subscription that executes a PowerShell command every 90 minutes. This can affect Windows operating systems as early as Windows 2000, including Windows 10 and Server editions.

If the EternalBlue exploit is patched, then it uses the MimiKatz to acquire credentials (logins and passwords) of the machines in order to gain access to the machine’s resources.

The fact that it uses built-in Windows tools to steal your resources, meaning it doesn't need a separate file to do its job, means that it is almost impossible to detect and remove it.

How do you know if you have the WannaMine virus?

Here's what to look for:
  • Slow computer or completely unusable
  • Apps crashing or not opening
  • High percentage of used CPU and RAM resources for countless hours, verified by Task Manager
  • Fans running loud all the time
  • Overheating
  • Battery draining on laptops
If left infected for a long time, severe damage of hardware can occur, so you need to be aware of the signs as well as take action immediately.

How can you prevent from getting infected?

Prevention is always better than the cure, especially with a difficult-to-detect malware such as this one.
  • Do not open suspicious emails or websites with pirated or indecent content
  • Use the Adblock Plus extension for your browser to prevent any pop-ups
  • Make sure you have the latest operating system and that Windows Updates are all current. Windows Vista and older versions are no longer supported by Microsoft, so it is highly recommended to upgrade your operating system if you are using an older operating system.
  • Download and install the Premium version of MalwareBytes Anti-Malware. The Premium version helps to prevent your browser from opening any websites that could be harmful, as well as block anything malicious from downloading.
  • Download and install either Panda or Sophos security package with real-time protection. You can also check online by searching with the keywords "wannamine" and your desired antivirus program to see if they have a fix for this malware.
  • Make sure you have a strong password for logging in to your computer.
  • Make sure System Restore is enabled and have a full backup on Cloud and / or an external drive of your files.

What to do if you are infected

  • Stop the network access to your computer to prevent further infection to other computers on your network.
  • Change your password.
  • Use MalwareBytes and your antivirus software to scan thoroughly for infections. Make sure they are updated and it’s best done in Safe Mode. Restart your computer at the end of the scan if they removed the infection and scan again.
  • Use the System Restore tool from Windows if the above method doesn’t work, to restore your computer to a date earlier than the time you got infected.
  • Format your computer if neither of the above work. Make sure you have a backup of your files on an external drive before proceeding. Use the Reset This PC option in Windows 10 with the option to keep your files, to see if that fixes the issue, otherwise use the other option that removes all files for a clean installation.
If the above methods seem tedious, or didn’t work, you need to take your computer to an expert, and as soon as possible, to prevent damage to the hardware. You can also find step-by-step guides on our blog or YouTube channel.

Disclaimer: The content provided in this article is for informational purposes only. You are solely responsible for verifying the information as being appropriate for your personal use.

Popular posts from this blog

New Page template button with timestamp in the title - Notion

These days I'm all about discovering ways for people to use Notion  without  the use of databases, as databases slow things down. I'm also an advocate for minimalism while still having an efficient workflow. Today I'm giving a tip with an example of daily journal entries. Usually, a Notion template comes with a database for journal pages, with a "Date created" property which is mighty convenient. But you can also replicate that without a database.  This will make it super fast for you to start journaling on a new page with the current date and time already added to the title. Create a simple text page where all your journal entries will be stored (no databases/tables). Optional: You may create a subpage to serve as an Archive for past entries. Again this should be a simple text page, not a database. You may also have multiple archives, named after the 12 months or years to keep things more organized. Type / , then template , then select the Template button . Give

How to rebuild cache and repair permissions of kexts in a Hackintosh

After installing 3rd-party kexts in /Library/Extensions, or replacing vanilla kexts with patched kexts in System/Library/Extensions, you may want to repair their permissions and rebuild the kext cache to ensure they work as intented. Here's how.

NVIDIA Web Drivers Mojave Workaround

It is still uncertain when will NVIDIA release any Web Drivers for macOS Mojave, but we can try a workaround.