Summary
Worry-Free Business Security (WFBS), OfficeScan (OSCE), and Worry-Free Business Security Services (WFBS-SVC) will restore the files that are already encrypted or modified by the ransomware process after detection. File restoration fails sometimes because the process locks the file due to unknown reasons. If the backup file is working but its restoration fails even after restarting the computer, you can manually restore it.
This feature is only available in WFBS 9.0 Service Pack 3 and OfficeScan 11.0 Service Pack 1 Critical Patch 6054, and OfficeScan XG.
Details
To manually restore the file:
- Go to the folder where the file restoration failed.
- Find the backup file (XXXXXXXXX.dre. EX:4100_3_5483BAD.dre) on the folder.
- Change the file extension to the same file name that failed to be restored (e.g. change the file name of 4100_3_5483BAD.dre to 4100_3_5483BAD.txt). You may find the original extension from detection logs.
- Open the file and check the content of the file.
