Dirty script knocked together to recover from a CryptoLocker infection. So you don't have to roll-back unaffected files: * Restore back to a separate folder * Amend first two lines as follows: * `strRestoreFolder` is the folder you restored from backuup * `strOriginalFolder` is your destroyed store * Highly recommend a test run by leaving `bolDo…

RestoreCryptolockerFiles.vbs

strRestoreFolder = "G:\Document"
strOriginalFolder = "E:\Document"

bolDoIt = false

strAffectedFiles = "odt, ods, odp, odm, odc, odb, doc, docx, docm, wps, xls, xlsx, xlsm, xlsb, xlk, ppt, pptx, pptm, mdb, accdb, pst, dwg, dxf, dxg, wpd, rtf, wb2, mdf, dbf, psd, pdd, eps, ai, indd, cdr, jpg, jpe, jpg, dng, 3fr, arw, srf, sr2, bay, crw, cr2, dcr, kdc, erf, mef, mrw, nef, nrw, orf, raf, raw, rwl, rw2, r3d, ptx, pef, srw, x3f, der, cer, crt, pem, pfx, p12, p7b, p7c, pdf, tif"

arrAffectedFiles = Split(arrAffectedFiles, ", ")

Set dicAffectedFiles = CreateObject("Scripting.Dictionary")
For Each i in arrAffectedFiles
    dicAffectedFiles.Add i
Next

strIgnoredFiles = ""
strCopiedFiles = ""
strNotFoundFiles = ""
strNewFiles = ""
strErrorFiles = ""

intFilesScanned = 0
intFilesCopied = 0
intFilesIgnored = 0
intFilesNotFound = 0
intNewFiles = 0
intErrorFiles = 0

bolContinue = true

dtmStart = Now()

'Search the root
Set objFSO = CreateObject("Scripting.FileSystemObject")
Set objFolder = objFSO.GetFolder(strOriginalFolder)
Set colFiles = objFolder.Files
For Each objFile in colFiles
    CheckAndCompare objFile.Path
Next

SearchSubFolders objFSO.GetFolder(strOriginalFolder)

intTotalTime = DateDiff("s", dtmStart, Now())

Wscript.Echo
Wscript.Echo
Wscript.Echo "Done in " & SecondsToTime(intTotalTime)
Wscript.Echo

Set objLog = objFSO.CreateTextFile("Move-Log.txt")
objLog.WriteLine "Done in " & SecondsToTime(intTotalTime)
objLog.WriteLine intFilesScanned & " files scanned"
objLog.WriteLine intFilesIgnored & " files modified"
objLog.WriteLine intFilesNotFound & " files not found"
objLog.WriteLine intNewFiles & " files new"
objLog.WriteLine intFilesCopied & " files copied"
objLog.WriteLine intErrorFiles & " files with errors"
objLog.WriteLine
objLog.WriteLine "-------------"
objLog.WriteLine "Modified Files"
objLog.WriteLine "-------------"
objLog.WriteLine
objLog.WriteLine strIgnoredFiles
objLog.WriteLine
objLog.WriteLine "-------------"
objLog.WriteLine "Not Found Files"
objLog.WriteLine "-------------"
objLog.WriteLine
objLog.WriteLine strNotFoundFiles
objLog.WriteLine
objLog.WriteLine "-------------"
objLog.WriteLine "New Files"
objLog.WriteLine "-------------"
objLog.WriteLine
objLog.WriteLine strNewFiles
objLog.WriteLine
objLog.WriteLine "-------------"
objLog.WriteLine "Error Files"
objLog.WriteLine "-------------"
objLog.WriteLine
objLog.WriteLine strErrorFiles
objLog.WriteLine
Set objLog = Nothing

Sub CheckAndCompare(FileName)
	intFilesScanned = intFilesScanned + 1
	Wscript.Echo SecondsToTime(DateDiff("s", dtmStart, Now())) & " " & FileName

	intDotPostion = InstrRev(FileName, ".")
	strExt = Right(FileName, Len(FileName) - intDotPostion)
	If dicAffectedFiles.Contains(strExt) Then
		strRightFile = FileName
		strLeftFile = Replace(FileName, strOriginalFolder, strRestoreFolder)

		If objFSO.FileExists(strRightFile) AND objFSO.FileExists(strLeftFile) Then
			On Error Resume Next
			Set objFileLeft = objFSO.GetFile(strLeftFile)
			Set objFileRight = objFSO.GetFile(strRightFile)

			If objFileRight.DateLastModified > objFileLeft.DateLastModified Then
				'Wscript.Echo "Modified"
				If bolDoIt Then objFileLeft.Copy strRightFile, true
				intFilesIgnored = intFilesIgnored + 1
				strIgnoredFiles = strIgnoredFiles & strLeftFile & VBCrLf
			Else
				'Wscript.Echo "Copied"
				If bolDoIt Then objFileLeft.Copy strRightFile, true
				intFilesCopied = intFilesCopied + 1
				'strCopiedFiles = strCopiedFiles & strLeftFile & VBCrLf
			End If

			Set objFileLeft = Nothing
			Set objFileRight = Nothing

			If Err Then

				intErrorFiles = intErrorFiles + 1
				strErrorFiles = strErrorFiles & "(" & Err.Description & ") " & strRightFile & VBCrLf

			End If

			On Error Goto 0

		ElseIf objFSO.FileExists(strRightFile) AND NOT(objFSO.FileExists(strLeftFile)) Then
			'Wscript.Echo "New"
			intNewFiles = intNewFiles + 1
			strNewFiles = strNewFiles & strRightFile & VBCrLf
		Else
			'Wscript.Echo "Deleted"
			intFilesNotFound = intFilesNotFound + 1
			strNotFoundFiles = strNotFoundFiles & strLeftFile & VBCrLf
		End If

	End If

End Sub

Sub SearchSubFolders(Folder)
    For Each Subfolder in Folder.SubFolders
        Set objFolder = objFSO.GetFolder(Subfolder.Path)
    	Set colFiles = objFolder.Files
        For Each objFile in colFiles
            CheckAndCompare objFile.Path
        Next
    	SearchSubFolders Subfolder
    Next
End Sub

Function SecondsToTime(ByVal intSeconds)
  Dim hours, minutes, seconds

  ' calculates whole hours (like a div operator)
  hours = intSeconds \ 3600

  ' calculates the remaining number of seconds
  intSeconds = intSeconds Mod 3600

  ' calculates the whole number of minutes in the remaining number of seconds
  minutes = intSeconds \ 60

  ' calculates the remaining number of seconds after taking the number of minutes
  seconds = intSeconds Mod 60

  ' returns as a string
  SecondsToTime = Right("00" & hours, 2) & ":" & Right("00" & minutes, 2) & ":" & Right("00" & seconds, 2)
End Function