rename 2nd extension but allow for duplicates - powershell

Question

I have a server that was infected with ransomware. I have decrypted most of it, but now have files that are a changed filetype or that have been renamed that I need to check:
newsfeed.xml.BLACK_MAMBA_Files#QQ.COM.BLACK_MAMBA_Files#QQ
Google Chrome.lnk.BLACK_MAMBA_Files#QQ
I tried
ren *.BLACK_MAMBA_Files#QQ* *.
I was thinking this would rename all the files, removing the extra text but keeping the original file extension. The error I received was
A duplicate file name exists or the file cannot be found.
I have very limited experience with the command prompt and no experience with PowerShell. If anyone can advise how I should go about this or an alternative, I would appreciate it.

Answer 1

This will rename files to remove the .BLACK_MAMBA_Files suffix in any form:
Get-ChildItem C:\folder -Recurse | Where-Object { $_.Name -like "*BLACK_MAMBA_Files*" } | Rename-Item -NewName { $_.Name -replace ".BLACK_MAMBA_Files.*",""} -WhatIf
NOTE:
I've added -WhatIf as I've only tested this with the two examples you've included. I'm confident it will work fine but it's best to test it first.
With this parameter included you can run the command and it will only display the the results of the rename command, but not actually complete the rename for real.
Remove -WhatIf from the end when you've confirmed that the rename process works correctly with your files.

Answer 2

Edit Reworked the script to work with a RegEX
If the extension is appended multiple times,
run this script as often to remove all occurences.
PushD 'X:\folder\to\start'
$Pattern = '(\.COM)*\.BLACK_MAMBA_Files#QQ'
Get-ChildItem -Recurse -File -Filter "*BLACK_MAMBA*"|
Where Name -match $Pattern|
ForEach {
If (!(Test-Path ($_.FullName -replace $Pattern))) {
$_|Rename-Item -NewName {$_.Name -Replace $Pattern} -confirm
} Else {
"can't rename $($_.FullName) ´`r`nbecause $($_.FullName -Replace $Pattern) already present"
}
}
PopD
If the script works OK, remove the -Confirm at the end of the Rename-Item.

Answer 3

You Can try this but you should test it first
Get-ChildItem -Path c:\PathtoDirectory -recurse |
Where {$_.FullName -Like "*.*BLACK*"} |
Foreach {Rename-item -Path $_.FullName -NewName $_.BaseName}
With the below command you can see the orignal file name is now the base name so we can use that property to rename them.
Get-Item -Path C:\PathtoFile | select *
You will have to run the command twice for the files with .com on the extention.

Answer 4

#ECHO OFF
SETLOCAL enabledelayedexpansion
SET "sourcedir=U:\sourcedir"
SET "outfile=U:\report.txt"
(
FOR /f "delims=" %%a IN (
'dir /b /s /a-d "%sourcedir%\*.BLACK_MAMBA_Files#QQ*" '
) DO (
SET "newname=%%a"
SET "newname=!newname:.BLACK_MAMBA_Files#QQ=?!"
FOR /f "delims=?" %%r IN ("!newname!") DO ECHO REN "%%a" "%%~nxr"
)
)>"%outfile%"
GOTO :EOF
You would need to change the setting of sourcedir to suit your circumstances.
This simple batch should put you on the path. I used my u: ramdrive for testing.
Starting at the directory you define as sourcedir, perform a directory list for filenames only (no directorynames) including subdirectories. Assign each name found matching the mask ".BLACK_MAMBA_Files#QQ" to %%a.
Using the facilities available with delayed expansion, assign %%a to newname, then replace each occurrence of the target string with ?, which is an illegal filename character.
Then use the default tokens=1 with delims=? to assign the first part of the resultant name in newname - up to the first delimiter (which is ?) to %%r.
Then rename using just the name and extension parts of %%r (as that's the only part ren will accept).
I chose to output the ren commands by parenthesising the entire nested for statement and redirecting the output to the file defined as outfile. If this was a .bat file, then you should examine it for sanity and then just run the output file as another batch if it appears to be appropriate. This also allows you to retain a record of the modifications done.