Need help with a Windows copy script "with rules"

[DaRk_ViVi]

Today a client got Cryptolocker and lost part of its files.
This is not a big issue as we have backup running and updated but I'm facing an issue on restoring files.

Long story short I need to run a copy script that act like this:

IF file.ext.enc is present in destination (C:\ folder)
\ Copy file.ext from source folder (on a nas)
\ Delete file.ext.enc
ELSE
Skip and go on with file2.ext.enc

It needs to check if there is there is the .enc file in the destination (aka the crypted one) and copy the file ONLY if exists (and in this case delete the .enc), else just go on with the next file/folder

This needs to go on for all folder and subfolder of the source and destination

Any help?
It doesn't need to be a script, I can also use some utility that does the same.

Thanks!

 

[FaTaL_ErRoR]

Yeah, you use the copy file transacted function to look for the ext.enc file and return from it either bool or error. (error would be moving on to file2 ext.enc in your situation.)
A great spot for what you are looking for.
http://stackoverflow.com/questions/20187912/how-to-execute-certain-commands-if-a-file-does-not-exist
But, if your client has cryptolocker then why don't you use one of the many tools to decrypt?
http://www.thewindowsclub.com/list-ransomware-decryptor-tools
One of the funniest ransomewares ever made. If you need more help please feel free to ask for it.

 

[DaRk_ViVi]

Yeah, you use the copy file transacted function to look for the ext.enc file and return from it either bool or error. (error would be moving on to file2 ext.enc in your situation.)
A great spot for what you are looking for.
http://stackoverflow.com/questions/20187912/how-to-execute-certain-commands-if-a-file-does-not-exist
But, if your client has cryptolocker then why don't you use one of the many tools to decrypt?
http://www.thewindowsclub.com/list-ransomware-decryptor-tools
One of the funniest ransomewares ever made. If you need more help please feel free to ask for it.

I've already tried that but didn't manage to get a decryption.
However I actually manage to get the job done with a bit more work:

- Dir the *.enc on the drive to a txt file
- A couple of replaces in the file to adapt the path to the backup
- I've used this website to merge the two txt to a single one adding the " and the copy command to the lines
- Saved it as a .bat and voilà
Bonus: scripted a deletion of *.enc and recovery instructions file in the restored folders