I have a question.
I am helping a friend recover from a cryptovirus. They ended up paying the ransom and ran the decrypt program, but it left all the files with "DECRYPT_filename" as a result. It also left the old encrypted filenames behind.
How can I strip the "DECRYPT_" from the beginning of the name? and then overwrite the old existing files?
What a pain in the neck.
Thanks