Free tools Windows power users keep installed
One-click scans. No signup required.
iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
EternalBlue remains a risk to Windows computers and servers that are missing the relevant security updates or still expose vulnerable SMBv1 services. It is not a new threat to every Windows device: Microsoft fixed the associated flaws in March 2017, and the danger today is chiefly a legacy-system and patch-management problem. A 2024 security assessment report says its team continued to encounter and exploit MS17-010/EternalBlue, but it does not estimate how many vulnerable systems exist worldwide.
What EternalBlue is—and what it is not
EternalBlue is exploit code associated with flaws in Microsoft’s Server Message Block version 1 (SMBv1), a Windows file- and printer-sharing protocol. Microsoft addressed the relevant SMB vulnerabilities in security bulletin MS17-010, published March 14, 2017. The bulletin warned that the most severe flaws could permit remote code execution if an attacker sent specially crafted messages to an SMBv1 server.
EternalBlue is often confused with BlueKeep because the U.S. National Security Agency issued an advisory about BlueKeep. They are separate vulnerabilities affecting different services: EternalBlue is associated with SMBv1 and MS17-010; BlueKeep is CVE-2019-0708 in Remote Desktop Services (RDP). The NSA’s June 2019 BlueKeep advisory concerns RDP, not EternalBlue.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
How EternalBlue became widely known
In May 2017, Microsoft reported that the WannaCrypt (also called WannaCry) ransomware worm used publicly available EternalBlue exploit code, including CVE-2017-0145, to spread. An unpatched computer reachable over SMB could be infected; infected machines could then help spread the malware to other reachable systems. Microsoft’s WannaCrypt analysis described the attack as exploiting a vulnerability that had already been patched.
#1 Best Overall
That history explains why SMB exposure matters, but it does not mean the 2017 outbreak is recurring now. The enduring lesson is that malware able to move between reachable systems can turn one unpatched machine into a wider network incident.
Why the old flaw can still matter
Installing the applicable Microsoft security update removes the specific MS17-010 vulnerability; the mere existence of EternalBlue does not make a patched system vulnerable to that flaw. Risk remains where systems were missed, cannot be updated, or are exposed through obsolete configurations and unnecessary SMB access.
RSM’s 2024 attack-vectors report says its team continued to see and exploit MS17-010/EternalBlue, alongside other long-patched vulnerabilities. This is evidence that vulnerable systems persisted in the assessment context—not a census, a count of global exposures, or a measure of current attack volume. The available evidence does not establish how many data centers are vulnerable today or what share of ransomware uses EternalBlue.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →MITRE ATT&CK’s living Exploitation of Remote Services (T1210) entry places SMB exploitation in the broader context of attackers using remote services to move through networks. Its mitigations include software updates, vulnerability scanning, network segmentation, and disabling unnecessary services.
Rank #3
What Windows users should do
Install updates and check support status
Install Windows updates applicable to the version on the device, and use a supported Windows release where possible. For a managed or older machine, confirm its exact edition and update history rather than assuming that a general update notice covers it. Microsoft’s MS17-010 bulletin identifies the addressed issues and affected software.
Scan if you suspect an infection
If a computer behaves as though it may be infected, use Windows Security or another reputable antimalware product to scan it, and follow Microsoft’s ransomware guidance. A scan can help detect or address malware, but it does not install the SMB security update or make an unpatched system safe.
What administrators should do across a network
Verify patching and inventory exceptions
Check update status for servers, workstations, appliances, and other Windows systems that provide or use SMB. Identify unsupported or unpatchable devices explicitly; an untracked legacy system can remain a weak point even when most of the environment is current.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallOutdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchAssess SMBv1 dependencies before disabling it
Inventory where SMBv1 is enabled and determine whether any application or device still requires it. Microsoft lists disabling SMBv1 as a workaround for Vista and later, while the MS-ISAC primer recommends disabling it where appropriate and using SMBv2 or SMBv3 after dependency checks. Test before changing production systems so a legacy dependency does not cause an outage. See the MS-ISAC EternalBlue primer.
Best Value
Limit SMB reachability and contain legacy systems
Restrict inbound SMB from the internet and limit internal SMB communications to systems that need them. Segment systems by role and trust level so a compromised host cannot freely reach unrelated machines. If a device cannot be patched, isolate it as much as its function allows, apply strict access controls, and increase logging and monitoring; RSM recommends compensating controls for systems that cannot be updated.
Scan and monitor routinely
Use vulnerability scanning to find systems missing updates or retaining risky services, and monitor remote-service activity for unexpected connections or lateral movement. MITRE ATT&CK identifies software updates, vulnerability scanning, segmentation, and disabling unnecessary services as mitigations for exploitation of remote services. These controls reduce exposure and improve detection; they do not replace applying the relevant fix.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.How EternalBlue and BlueKeep differ
| Threat | Service or protocol | Identifier | Relevant action |
|---|---|---|---|
| EternalBlue | SMBv1 | Associated with the SMB flaws addressed by MS17-010, including CVE-2017-0145 | Apply applicable MS17-010 updates; assess SMBv1 need and restrict SMB access |
| BlueKeep | Remote Desktop Services (RDP) | CVE-2019-0708 | Apply the relevant BlueKeep patch and follow RDP-specific controls in the NSA advisory |
The two issues should not be treated as interchangeable: a mitigation for SMBv1 does not automatically address an RDP vulnerability, and an RDP control does not patch MS17-010.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
