cody/ruby-windows-scripts
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Formatted readme

Browse Source
This commit is contained in:
Jacob Cody Wimer
2015-03-30 10:48:42 -04:00
parent ddbb416c70
commit 2eaa5949e2
1 changed files with 26 additions and 24 deletions
Download Patch File Download Diff File Expand all files Collapse all files

50
README.md
View File

@@ -2,32 +2,34 @@
This program creates a txt for easy backup restoration of files infected with cryptowall. The program depends on the decrypt instrucitons left behind by cryptowall.
For example, if you have two folders on your desktop that contain the following files:
folder1
DECRYPT_INSTRUCITON.TXT
DECRYPT_INSTRUCTION.lnk
DECRYPT_INSTRUCTION.HTML
myfile.txt
myOtherFile.txt
folder2
DECRYPT_INSTRUCITON.TXT
DECRYPT_INSTRUCTION.lnk
DECRYPT_INSTRUCTION.HTML
myThirdFile.txt
myFourthFile.txt
* folder1
- DECRYPT_INSTRUCITON.TXT
- DECRYPT_INSTRUCTION.lnk
- DECRYPT_INSTRUCTION.HTML
- myfile.txt
- myOtherFile.txt
* folder2
- DECRYPT_INSTRUCITON.TXT
- DECRYPT_INSTRUCTION.lnk
- DECRYPT_INSTRUCTION.HTML
- myThirdFile.txt
- myFourthFile.txt
The program will do the following:
1. It will create a txt containing:
folder1path\myfile.txt
folder1path\myOtherFile.txt
folder2path\myThirdFile.txt
folder2path\myFourthFile.txt
2. It will delete the following files:
folder1\DECRYPT_INSTRUCTION.TXT
folder1\DECRYPT_INSTRUCTION.lnk
folder1\DECRYPT_INSTRUCTION.HTML
folder2\DECRYPT_INSTRUCTION.TXT
folder2\DECRYPT_INSTRUCTION.lnk
folder2\DECRYPT_INSTRUCTION.HTML
* 1. It will create a txt containing:
- folder1path\myfile.txt
- folder1path\myOtherFile.txt
- folder2path\myThirdFile.txt
- folder2path\myFourthFile.txt
* 2. It will delete the following files:
- folder1\DECRYPT_INSTRUCTION.TXT
- folder1\DECRYPT_INSTRUCTION.lnk
- folder1\DECRYPT_INSTRUCTION.HTML
- folder2\DECRYPT_INSTRUCTION.TXT
- folder2\DECRYPT_INSTRUCTION.lnk
- folder2\DECRYPT_INSTRUCTION.HTML
Hopefully, having the txt produced by this program will help you easily restore files infected by cryptowall. The program was only written to search local hard drives (not usb or network drives). This functionality can be easily added if needed just ask me. It is advised to not run this on systems in which cryptowall is still encrypting files. Make sure the computer is clean (or running in safe mode) before running this program.