An attempt to stop the WannaCry 2.0 ransomware from spreading to your PC by using mutual exclusion algorithms on Windows at each restart.
- CCN-CERT NoMoreCry Tool
- Version :0.3
- License :Trial
- OS :Windows All
- Publisher :CCN-CERT
CCN-CERT NoMoreCry Tool Description
Created by the Computer Security Incident Response Team in the Spanish Government National Cryptologic Center, the CCN-CERT NoMoreCry Tool aims to prevent the spread of the WannaCry 2.0 ransomware by generating a mutual exclusion algorithm on the host machine.
In other words, by creating a mutex, the ransomware should be tricked into thinking that it is already running on the host machine, so it will not execute the malicious code once more.
Therefore, the CCN-CERT NoMoreCry Tool is exactly like a vaccine in real life, running a piece of code to prevent the payload to run on a computer, which isolates “patient zero,” your computer. On the other hand, the Microsoft patch released after WannaCry’s outbreak is designed to inhibit the worm-like behavior of the malware.
To be noted that this application is not intended to clean infected computers. In fact, its effect only lasts until the next restart. Therefore, it must be launched at startup each time the PC boots to Windows.
This small patch only fixes the vulnerability that the ransomware uses to spread across the local network. To be more clear, it will not protect you if you access an infected email attachment. Although it is interesting to analyze it and perhaps test it at the moment, it does not replace the permanent antivirus solution and the responsible cyber-security conduct.