I'm trying to recover some file from a Windows archive affected by a stupid Crypt0L0cker ransomware. In fact, after a quick check moving files to my own system, it seems that the malware just added a second -random- extension to the files (yah, I know that extension doesn't mean nothing). Renaming the files manually just works.List for 2016.doc.irolox -> manually rename in -> List for 2016.doc I would like to have some tips to run this workflow:loop recursively in all subdirectory of a given folderfiles contains spaces in the name (but they don't contains dots in the real name)some files seems not to be affected. Rule: don't consider them if they just have ONE extension (so if 2 dots are detected -> file is affected)rename files removing the last extension.Any tip to achieve this result?
Remove recursively double extension added by stupid Crypt0L0cker ransomware
find;filenames;rename;malware
First go to the folder archive, then run this:find | awk -F'.' '{if ($3 !=  && $4 !=  ){system(mv $0 ./$2.$3)}}'this will look for every file in the folder and in sub folders and if it find that the file have tow extension it will rename it with just the first extension for example the folder before the command:../lolo.doc./soso./soso/jojo.doc.koko.momo./kokooiko.doc.soso./jojo.doc.kokothe folder after the comamnd:../lolo.doc./kokooiko.doc./jojo.doc./soso./soso/jojo.doc