Ok! Found a solution!

I read that the shadow copies have links to \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy

So I created a symlink on the machine with the following command:

ex: mklink...

Hello!
I've a customer with a vista computer (i know, spare the flame:ing :)) it was infected with crypt0l0cker and after restoring it to a previous restore point it seems like the SAM hives or...