I'm trying to recover some file from a Windows archive affected by a "stupid" Crypt0L0cker ransomware. In fact, after a quick check moving files to my own system, it seems that the malware just added a second -random- extension to the files (yah, I know that "extension" doesn't mean nothing). Renaming the files manually just works.
"List for 2016.doc.irolox" -> manually rename in -> "List for 2016.doc"
I would like to have some tips to run this workflow:
- loop recursively in all subdirectory of a given folder
- files contains spaces in the name (but they don't contains dots in the real name)
- some files seems not to be affected. Rule: don't consider them if they just have ONE "extension" (so if 2 dots are detected -> file is affected)
- rename files removing the last "extension".
Any tip to achieve this result?