The best way to combat the effects of WannaCry right now is to restore lost files from a backup. As far as we've been able to determine, the ransomware's 'crypto' hasn't been broken, which rules out a complete reversal. However, WannaCry generates a certain number of temporary files before hijacking a computer's contents, and if those temporaries were left 'orphaned' due to an anti-ransomware block or another external factor, the WannaCry File Restorer tool from ElevenPaths and Telefónica can recover them.
It's already been a week since WannaCry turned the web into its private amusement park, and experts around the globe are still cleaning up the mess. In the coming hours, the ransom deadline is likely to expire on a good number of affected terminals. The number one recommendation remains not to pay, but the truth is that many users already have. Without a robust backup policy and with the desperation to recover data, giving in to the demand becomes the quickest solution. Still, there are other options.
A computer keeps copies of unencrypted files in temporary folders, recycle bins, or via the Windows Shadow Copy system. If an older version of those files was deleted, Recuva or a similar program might be able to rescue the user.
And finally, there are the temporary files generated by WannaCry.
https://www.youtube.com/embed/c6z85-5hy5cWannaCry File Restorer
That's where the WannaCry File Restorer tool from ElevenPaths and Telefónica comes in. In essence, we're looking at a PowerShell script that locates files with the .WNCRYT extension, analyzes each one's header, and restores them to their previous condition.
The .WNCRYT extension indicates files that were targeted by WannaCry and left waiting to be encrypted, without completing the process. Files that were already encrypted carry the .WNCRY extension, but WannaCry File Restorer cannot do anything with them. The strategy here is to try to recover the .WNCRYT files deleted by WannaCry after encryption, then restore their original format by running the script.
No, it's not ideal—we're the first to admit that. The average user would surely prefer an executable capable of fully reverting WannaCry's effects, but we have to be realistic and consider that a tool with those characteristics might not be possible to create. WannaCry File Restorer is the middle ground, another resource to add to our arsenal and try to minimize the impact of this nefarious ransomware. The script is in alpha version and should be treated as a proof of concept, but within its limitations, it works quite well.
