Recursively add suffix after extension to all files in a directory

I had a ransomware attack and all files were encrypted.

The encryption added a suffix to all the files after the extension for example 123.jpg became 123.jpg.[xyz@gmail].xyz

I got the key and decrypted the files.

The key looks for the suffix and the encryption key in the file to unlock it. Once decrypted the suffix comes off.

The problem is some files were encrypted twice, so I need to run the key a second time but since they don't have the suffix the key does not work.

I need to go and add the [xyz@gmail].xyz to all the files regardless of their extension so I can run the key a second time.

LabMan

Posted 2019-12-09T01:35:16.737

Reputation: 43

4What Operating System are you running? Windows 10? – Pimp Juice IT – 2019-12-09T02:35:59.160

4Also, may I ask how you got the key? Did you have to pay the ransom for it or did they use a form of encryption where the decryption or private key or whatever was stored locally? – Pimp Juice IT – 2019-12-09T02:46:32.503

Yes I paid. The attack was on windows 7 and NAS attached to the network. Now I am on windows 10 – LabMan – 2019-12-10T07:51:55.377

@LabMan How did the ransomware get on your system? – InterLinked – 2019-12-10T20:29:07.973

Answers

Run the below command in PowerShell

ls -File -Recurse | % { Rename-Item $_.FullName $($_.BaseName + ".[xyz@gmail].xyz") -WhatIf }

After checking that the new names are correct, just remove -WhatIf to do the real rename

phuclv

Posted 2019-12-09T01:35:16.737

Reputation: 14 930

Thanks. It worked! Been busy recovering to thank you earlier :) – LabMan – 2019-12-22T15:26:24.780

One of the FREE top 5 Windows utilities I use is called "Bulk Rename Utility". You have the option of selecting one or more files and can also do high powered regex search and replace. It can be downloaded from https://www.bulkrenameutility.co.uk/

It looks daunting at first, but you will quickly understand how it works and you can quickly do very simple tasks, or if needed extremely complex ones too. It is truly FREE. No trials, nag screens or crippled ware. The full functioning program is FREE.

jwzumwalt

Posted 2019-12-09T01:35:16.737

Reputation: 268

Thank you I tried that but it makes the change before the extension and not after for example if I add suffix abc to file xxxx.jpg, it becomes xxx.abc.jpg. I need to make it xxx.jpg.abc – LabMan – 2019-12-22T15:25:23.877

I don't have a windows machine in front of me at this moment but look at item 11 "extension". There is also a way for it to treat the extension inclusive in search and replace but I do not rember how I did that a few years ago. – jwzumwalt – 2019-12-22T19:11:09.157