2

I'm trying to recover some file from a Windows archive affected by a "stupid" Crypt0L0cker ransomware. In fact, after a quick check moving files to my own system, it seems that the malware just added a second -random- extension to the files (yah, I know that "extension" doesn't mean nothing). Renaming the files manually just works.

"List for 2016.doc.irolox" -> manually rename in -> "List for 2016.doc"

I would like to have some tips to run this workflow:

  • loop recursively in all subdirectory of a given folder
  • files contains spaces in the name (but they don't contains dots in the real name)
  • some files seems not to be affected. Rule: don't consider them if they just have ONE "extension" (so if 2 dots are detected -> file is affected)
  • rename files removing the last "extension".

Any tip to achieve this result?

2

First go to the folder archive, then run this:

find | awk -F'.' '{if ($3 != "" && $4 != "" ){system("mv "$0" ./"$2"."$3)}}'

this will look for every file in the folder and in sub folders and if it find that the file have tow extension it will rename it with just the first extension

for example the folder before the command:

.
./lolo.doc
./soso
./soso/jojo.doc.koko.momo
./kokooiko.doc.soso
./jojo.doc.koko

the folder after the comamnd:

.
./lolo.doc
./kokooiko.doc
./jojo.doc
./soso
./soso/jojo.doc
  • 1
    Should your jojo.doc.koko.momo have been renamed to jojo.doc.koko? It's an interesting one this because the OP guarantees no dots in the file name so I suspect you've done the right thing even though it's not exactly what's been asked for. Meanwhile +1 – roaima Dec 13 '16 at 14:40
0

You can use variable substitution like:

MYVAR="List for 2016.doc.irolox"
echo ${MYVAR%.*}

The above removes the shortest match .* from the backend of the variable value.

This way you can rename the file using:

mv "${MYVAR}" "${MYVAR%.*}"
0

Solution

Create a script which will take an arbitrary number of arguments and will rename the files removing the arbitrary extensions. For example,

cat > /tmp/rename_script.sh <<'EOF'
#!/bin/bash
while [ $# -gt 0 ]; do
  mv "$1" "${1%.*}"
  #alternatively to strip multiple extensions
  #mv "$1" "${1%.doc.*}.doc"
  shift
done
EOF
#enable execute perms
chmod 755 /tmp/rename_script.sh

The following find command will pass one or more affected files as arguments to the rename_script.sh (-execdir will execute rename_script.sh from the working directory of the affected files). The following is an example.

find /path/to/affected/dir -type f -name '*.doc.*' -execdir /tmp/rename_script.sh {} +

NOTE: I recommend you operating on a small sample size of files to initially test. Back up the old "ransomware files" before executing this solution on all of the files.

Tested with find (GNU findutils) 4.4.2 on Debian 8/Jessie.

Additional Reading

  • man bash and look up Special Parameters, Parameter Expansion, and Compound Commands.
  • man find and look up -execdir option.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.