Frenchmen claim cure for WannaCry-infected computers

Frenchmen claim cure for WannaCry-infected computers

The developers released the tool on Friday, as the deadline expires for computers all over the world first infected a week ago.

One drawback is that the fix only works if the computers were not rebooted from the moment of infection. Europol tweeted that its European Cybercrime Centre had checked the team's new tool and found that it can recover files in certain circumstances.

The researchers - Adrien Guinet, Matthieu Suiche and Benjamin Delpy - worked separately to find ways to decrypt files scrambled and held hostage by WannaCry. After consecutively working for two days, Delpy said "we knew we must go fast because, as time passes, there is less chance to recover".

Tests reveal that Wanakiwi works on Windows 7 and older versions of Windows XP and 2003, according to Suiche, who believes that the rapidly designed solution also works on Windows Vista and Windows 2008. As of Friday, the three accounts known to collect ransom payments had received less than $100,000 worth of the cybercurrency bitcoin, an amount that security researchers say is small compared with how widely WannaCry spread.

His blog post links to a Delpy's "wanakiwi" decryption tool which is based on Guinet's original concept. He added the software helps recover the prime numbers of the RSA private key that are used by WannaCry.

"This is not a ideal solution", Suiche said.

As of Wednesday, half of all internet addresses corrupted globally by WannaCry were located in China and Russian Federation, with 30% and 20% of infections, respectively, according to data supplied by threat intelligence firm Kryptos Logic.