WannaCry caused a disaster. Its effects are still felt, and experts agree this was only the first attack. Microsoft had fixed the vulnerability in March, and even issued out-of-band patches for unsupported operating systems, but if for some reason those hotfixes can't reach your terminals, the Spanish National Cryptologic Center based in Madrid published NoMoreCry, a script whose goal is to prevent WannaCry infection in the first place.
Everything seems to indicate that the world now has a great interest in ransomware. Unfortunately, it took the fall of Telefónica, the British health system, and almost a quarter million computers in 150 countries. For several years, specialized media have been warning about the danger of ransomware, and in most cases those warnings were labeled as exaggerated or bordering on paranoia. Well... the party is over. The blow of WannaCry turned out to be brutal, and no one laughs when an ambulance must be redirected to another hospital because the terminals of the first establishment were trapped. Microsoft's response was satisfactory, but its out-of-band patch for XP reminds us that update cycles are still far from over. That's how we arrive at NoMoreCry, a "digital vaccine" created by the Spanish National Cryptologic Center in Madrid.
Basically, we are dealing with a mutex, a lock if you will. The script seeks to block the execution of WannaCry on the terminal and by extension prevent the encryption of personal files. The official CCN report is very complete, and our basic recommendations are in line with what is exposed there, but NoMoreCry serves as a last resort for vulnerable terminals that cannot be protected in a traditional way. Now, NoMoreCry comes with two warnings: The first is that it does not serve to decrypt files or clean infected systems with WannaCry. The role of NoMoreCry is prevention, nothing more. The second is that it has no persistence on the computer, therefore, the administrator must configure its execution each time the operating system boots.
The good news is that NoMoreCry extends its compatibility to Windows 2000. Several statistics portals stopped tracking Windows 2000 due to its low market share, but if WannaCry proved anything, it is that there are still very old terminals connected to the network...
