List all files that have write access by a specific user

Hi all,

I've been hit with one of those crypto-ransom viruses. A specific user ("domain\username") has had all files that they have write permissions to encrypted. Now I need to restore these files from DPM, but first I would like to know what files on the file server they have write access to.

So in Windows, is there a way I can generate a list of files that user ("domain\username") has write access to?

Thanks for reading.
StengleAsked:
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

WaronyaCommented:
Have you cleaned the virus yet? I think it would be better to isolate/disinfect the virus first before restoring as they will attack again.

Try these tools I have used fix a similar problem make the files accessible.  
1. Adwcleaner http://www.bleepingcomputer.com/download/adwcleaner/
2.  Combofix http://www.bleepingcomputer.com/download/combofix/

Once done disinfecting ensure you have a good working antivirus with the latest signature updates.
0
StengleAuthor Commented:
Hi Waronya,

Yes I cleared up the virus ASAP. Most files that the guy had access to have been encrypted and we are not paying the decryption fee - the only way we can get our files back it to restore them from DPM.

Which is why I need to know if there is a way I can generate a list of files that this guy has write access to.
0
WaronyaCommented:
Try the free AccessEnum tool (http://technet.microsoft.com/en-us/sysinternals/bb897332.aspx)  AccessEnum is a very simple application that helps you visualize the permissions assigned to a specific folder structure.
0

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
StengleAuthor Commented:
Great tool, thanks Waronya. Your link also took me to:
- http://technet.microsoft.com/en-us/sysinternals/bb664922
Which is also nice :-)
0
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Microsoft Legacy OS

From novice to tech pro — start learning today.