Page 1 of 1

bulk rename special

Posted: 08 Nov 2018 21:03
by davemargerum
We recently had some of our files encrypted by ransomware. When they encrypted the files, they accidentaly added a . to the end of each file. In order for the decryptor to work , the trailing period needs to be removed. I have been able to use rename special, and edit items name to remove the trailing period. Is there a way to do this in bulk. There are approx 350,000 files in many folders and subdirectories that need the trailing period removed. Any ideas how to do this, or if it's possible?


Thanks

Re: bulk rename special

Posted: 08 Nov 2018 22:01
by highend
You could use XYs normal search (Ctrl + f), switch the "Mode" to RegExp
and use this pattern in the "Name" field:

Code: Select all

\.\.[^.]+$
Additionally, switch to the Attributes tab and check the Not field (the left one) for
Directory (because you only want to find files, not folders)
Use the "Find Now" button and select all found files in the search pane afterwards

And now run this script:

Code: Select all

    setting "BackgroundFileOps", 0;
    $files = <get "SelectedItemsPathNames" <crlf>>;
    foreach($file, $files, <crlf>, "e") {
        renameitem(trim(gpc($file, "base"), ".", "R") . "." . gpc($file, "ext"), $file);
    }
This will take a (long) time on so many files...

And ofc, you should test this on a few sample files first!

Re: bulk rename special

Posted: 12 Nov 2018 16:31
by davemargerum
thanks for your help. Here's a bit more specifics. All the files were appended with the following extension .[divinehelp235@airmail.cc].
for example: desktop.ini was renamed to desktop.ini.[divinehelp235@airmail.cc].
Once the trailing period is removed desktop.ini.[divinehelp235@airmail.cc] the decrypter works for me


Thanks for your help

Re: bulk rename special

Posted: 12 Nov 2018 18:06
by highend
XY seems to refuse to rename such a file via scripting...

Try this (no guaranties!) instead
Traling dot renamer.zip
Extract it, start it with admin permissions!, point it to a folder or drive (for testing purposes, I'd use a folder)

What does it do? Scans the folder / drive recursively ONLY for files and looks for those that have a trailing dot
Those are forcefully! renamed to one without that dot. Failed to rename file names are stored in a log file (called "Failed.txt") in
the same folder as the .exe...