Infected by ransomeware - how to rename files?

Post any general comments regarding Bulk Rename Utility here. Open to all registered users.

Infected by ransomeware - how to rename files?

Postby Jonnoxx » Sat May 26, 2018 3:02 pm

My PC has been infected with a nasty virus which is rapidly changing file names by adding extra text onto the end of the file names.

I'm having difficulty choosing the correct options to use BRU to rename these files, and need some advice on how to go about this.

Here's an example of a file name that's been infected:
scenery_packs.ini.3060763877.ransomed@india.com

which obviously must be renamed back to:
scenery_packs.ini

All the infected files have the same .##########ransomed@india.com suffix attached to them. The 10 digit numeral varies of course.

There's no problem renaming the files manually one-by-one. And once they are renamed, they work properly as before. But there are 100 000 of them. And therein lies the challenge!

I first thought the easiest strategy would be to simply delete the last n number of characters from the end of each file name, but the program doesn't want to do this.

I've tried some other strategies, but BRU seems confused by the multiple suffixes appearing (.ini and .com) in the same filename, and keeps wanting to (un)helpfully add a .com onto the end of the file name each time. :evil:

I'm obviously a newbie at bulk file renaming, and am not seeing how to tackle this problem.

Please help
Jonnoxx
 
Posts: 5
Joined: Sat May 26, 2018 2:10 pm

Re: Infected by ransomeware - how to rename files?

Postby therube » Sun May 27, 2018 12:22 pm

Set, Renaming Options -> Ignore --> File Extensions

1:RegEx
Code: Select all
Match:  (.*)(\.\d\d\d\d\d\d\d\d\d\d\.ransomed@india\.com)
Replace:  \1
therube
 
Posts: 1314
Joined: Mon Jan 18, 2016 6:23 pm

Re: Infected by ransomeware - how to rename files?

Postby Jonnoxx » Mon May 28, 2018 1:42 pm

Thanks for that helpful example, and good advice and prompt response!

I would never have figured that out by myself.

I'm not sure how to set up BRU to automatically do this name-change across ALL the directories and folders in my drive - all at one go.

It only seems to work within individual folders?

Or am i missing something?
Jonnoxx
 
Posts: 5
Joined: Sat May 26, 2018 2:10 pm

Re: Infected by ransomeware - how to rename files?

Postby Jonnoxx » Mon May 28, 2018 4:47 pm

Am also getting the problem where BRU comes to a stop midway through the process with an error message "file contains invalid characters".

If you press OK, the whole operation aborts. And NOTHING gets renamed at all. Not good!

Is there a way to force the program to ignore the relatively few "problem files", and just continue on and re-name the ones that it can?
Jonnoxx
 
Posts: 5
Joined: Sat May 26, 2018 2:10 pm

Re: Infected by ransomeware - how to rename files?

Postby therube » Mon May 28, 2018 5:05 pm

Do you know which particular filenames it is not liking?
therube
 
Posts: 1314
Joined: Mon Jan 18, 2016 6:23 pm

Re: Infected by ransomeware - how to rename files?

Postby Jonnoxx » Mon May 28, 2018 5:29 pm

/ \ < > ? * | :
Jonnoxx
 
Posts: 5
Joined: Sat May 26, 2018 2:10 pm

Re: Infected by ransomeware - how to rename files?

Postby Jonnoxx » Mon May 28, 2018 5:41 pm

Sorry, misunderstood you.

Just had a quick visual scan through the files (27 000+), and did not notice any "red" files.

So it must be very few - but even just one would make it a show-stopper!

Trying to manually find a delinquent file is like looking for a needle in a haystack. Unless it can be automated, just not worth the time.
Jonnoxx
 
Posts: 5
Joined: Sat May 26, 2018 2:10 pm


Return to General Comments