Manually restoring backup files after a failed restoration process in Worry-Free Business Security, OfficeScan, and WFBS-SVC

- Updated:
- 25 Apr 2019
- Product/Version:
- OfficeScan 11.0
- OfficeScan 11.0
- OfficeScan XG
- OfficeScan XG.All
- Worry-Free Business Security Services 5.7
- Worry-Free Business Security Services 5.8
- Worry-Free Business Security Services 6.1
- Worry-Free Business Security Services 6.1
- Worry-Free Business Security Services 6.2
- Worry-Free Business Security Services 6.3
- Worry-Free Business Security Services 6.5
- Worry-Free Business Security Services 6.5
- Worry-Free Business Security Services 6.6
- Worry-Free Business Security Services 6.6
- Worry-Free Business Security Standard 9
- Worry-Free Business Security Standard/Advanced 9.0
- Platform:
- Windows 2012 Enterprise
- Windows 8.1 32-bit
- Windows 8.1 64-bit

Summary

Worry-Free Business Security (WFBS), OfficeScan (OSCE), and Worry-Free Business Security Services (WFBS-SVC) will restore the files that are already encrypted or modified by the ransomware process after detection. File restoration fails sometimes because the process locks the file due to unknown reasons. If the backup file is working but its restoration fails even after restarting the computer, you can manually restore it.

This feature is only available in WFBS 9.0 Service Pack 3 and OfficeScan 11.0 Service Pack 1 Critical Patch 6054, and OfficeScan XG.

Details

To manually restore the file:

Go to the folder where the file restoration failed.
Find the backup file (XXXXXXXXX.dre. EX:4100_3_5483BAD.dre) on the folder.
Change the file extension to the same file name that failed to be restored (e.g. change the file name of 4100_3_5483BAD.dre to 4100_3_5483BAD.txt).

You may find the original extension from detection logs.
Open the file and check the content of the file.