If you have a computer that is infected by the recent WannaCry ransomware attack, there is a glimpse of hope to gain access to your locked files without making the $300 to $600 payment demand.
French security researchers have developed a decryption tool that gets rid of the ransomware and restores your infected files. The new tool is available for free and works on Windows XP, Windows 7, Windows Vista, Windows Server 2003 and 2008 operating systems. Unfortunately, the tool will only work on those affected computers that have not been restarted since the infection.
The tool, known as “Wanakiwi” was created by security researcher Benjamin Delpy and it is based on an older fix called “WannaKey” created by Adrien Guinet. The tool attempts to search the computer’s memory for prime numbers that are the basis of the encryption. If you have rebooted your computer since becoming infected, it is possible those prime numbers have been lost. However, if you haven’t, Wanakiwi should be able to retrieve the keys and fix your encrypted files. It is also said to prevent the ransomware from encrypting more files in the future. You will need to download the tool and run it on the infected machine.
Matt Suiche, cofounder of security firm Comae Technologies, helped develop and test wanakiwi and reports that it works. Europol the European Union’s law-enforcement agency, has also validated the tool. Suiche has also published technical details here, and provided the following screenshot of the tool in action:
WannaCry has infected 300,000 computers in over 150 countries affecting healthcare, public transport, law enforcement, businesses, and individuals globally. A latest data from Kaspersky Lab has revealed that about 98 percent of the computers affected by the ransomware were running some version of Windows 7, with less than one in a thousand running Windows XP. It must be noted that Windows 10 is not affected by WannaCry.