scanactvmec

Restoring Encrypted Files

To prevent infected from being opened, OfficeScan encrypts the file during the following instances:

OfficeScan provides a tool that decrypts and then restores the file in case you need to retrieve information from it. OfficeScan can decrypt and restore the following files:

Files that OfficeScan can Decrypt and Restore

File

Description

Quarantined files on the client computer

These files are found in the <Client installation folder>\SUSPECT\Backup folder and are automatically purged after 7 days. These files are also uploaded to the designated quarantine directory on the OfficeScan server.

Quarantined files on the designated quarantine directory

By default, this directory is located on the OfficeScan server computer. For details, see Quarantine Directory.

Backed up encrypted files

These are the backup of infected files that OfficeScan was able to clean. These files are found in the <Client installation folder>\Backup folder. To restore these files, users need to move them to the <Client installation folder>\SUSPECT\Backup folder.

OfficeScan only backs up and encrypts files before cleaning if you select Backup files before cleaning in Networked Computers > Client Management > Settings > {Scan Type} > Action tab.

If the file is on the OfficeScan client computer:

  1. Open a command prompt and navigate to <Client installation folder>.

  2. Run VSEncode.exe by typing the following:

  3. VSEncode.exe /u

    This parameter opens a screen with a list of files found under <Client installation folder>\SUSPECT\Backup.

  4. Select a file to restore and click Restore. The tool can only restore one file at a time.

  5. In the screen that opens, specify the folder where to restore the file.

  6. Click Ok. The file is restored to the specified folder.

  7. Click Close when you have finished restoring files.

If the file is on the OfficeScan server or a custom quarantine directory:

  1. If the file is on the OfficeScan server computer, open a command prompt and navigate to <Server installation folder>\PCCSRV\Admin\Utility\VSEncrypt.

  2. If the file is on a custom quarantine directory, navigate to <Server installation folder>\PCCSRV\Admin\Utility and copy the VSEncrypt folder to the computer where the custom quarantine directory is located.

  3. Create a text file and then type the full path of the files you want to encrypt or decrypt.

  4. For example, to restore files in C:\My Documents\Reports, type C:\My Documents\Reports\*.* in the text file.

    Quarantined files on the OfficeScan server computer are found under <Server installation folder>\PCCSRV\Virus.

  5. Save the text file with an INI or TXT extension. For example, save it as ForEncryption.ini on the C: drive.

  6. Open a command prompt and navigate to the directory where the VSEncrypt folder is located.

  7. Run VSEncode.exe by typing the following:

  8. VSEncode.exe /d /i <location of the INI or TXT file>

    Where:

    <location of the INI or TXT file> is the path of the INI or TXT file you created (for example, C:\ForEncryption.ini).

  9. Use the other parameters to issue various commands.

    Restore Parameters

    Parameter

    Description

    None (no parameter)

    Encrypt files

    /d

    Decrypt files

    /debug

    Create a debug log and save it to the computer. On the client computer, the debug log VSEncrypt.log is created in the <Client installation folder>.

    /o

    Overwrite an encrypted or decrypted file if it already exists

    /f <filename>

    Encrypt or decrypt a single file

    /nr

    Do not restore the original file name

    /v

    Display information about the tool

    /u

    Launch the tool’s user interface

    /r <Destination folder>

    The folder where a file will be restored

    /s <Original file name>

    The file name of the original encrypted file

For example, type VSEncode [/d] [/debug] to decrypt files in the Suspect folder and create a debug log. When you decrypt or encrypt a file, OfficeScan creates the decrypted or encrypted file in the same folder. Before decrypting or encrypting a file, ensure that it is not locked.

See also: