Direkt zum Inhalt

Restore failed after Ransomware attacking

Thread needs solution
Beginner
Beiträge: 1
Kommentare: 0

Our customer has ransomware attack in their server. We’ve re-installed the Acronis backup advance v11.7 and trying to restore the server backup. However it always failed and got following error message:

TOL: Failed to execute the command. Recovering disks/volumes to new VM 'vm:C886501C-A456-4A1C-8217-4778C896E1FA?type%3dmshyperv'

Additional info:

--------------------

Error code: 22

Module: 309

LineInfo: 8d165e86fb8195f7

Fields:  TraceLevel : 1, $module : disk_bundle_vs_44421

Message: TOL: Failed to execute the command. Recovering disks/volumes to new VM 'vm:C886501C-A456-4A1C-8217-4778C896E1FA?type%3dmshyperv'

--------------------

Error code: 32788

Module: 114

LineInfo: 28314c961de7d41b

Fields:  $module : disk_bundle_vs_44421

Message: Failed to recover virtual machine 'MOR-SVR-01' with ID 'vm:C886501C-A456-4A1C-8217-4778C896E1FA?type%3dmshyperv'.

--------------------

Error code: 48

Module: 149

LineInfo: e64f8ac0f3f921cb

Fields:  $module : disk_bundle_vs_44421

Message: Cannot open emulated machine.

--------------------

Error code: 13

Module: 149

LineInfo: d1ab7fa1e56ec83e

Fields:  $module : disk_bundle_vs_44421

Message: Failed to perform the requested operation.

--------------------

Error code: 236

Module: 16

LineInfo: 7bb42efe3c733241

Fields:  $module : disk_bundle_vs_44421

Message: Internal error: Attempt to access emulated disk for non-initialized object.

--------------------

Error code: 94

Module: 83

LineInfo: 383ffdb092990e23

Fields:  $module : hv_srv_vs_44421

Message: Failed to open virtual disk file 'D:\Hyper-V\Virtual Hard Disks\MOR-SVR-01_2_B44BE8C9-F890-4730-AEBF-F7B9CA428A39.vhdx'.

--------------------

Error code: 212

Module: 83

LineInfo: 383ffdb092990dda

Fields:  $module : hv_srv_vs_44421

Message: Failed to create a multi-volume snapshot where files are located:

D:            \Hyper-V (virtual machine file location),

D:            \Hyper-V (virtual machine snapshot file location),

D:            \Hyper-V\Virtual Hard Disks\MOR-SVR-01_1_5D77FEEE-9A07-4620-A5B6-98141799DBAF.vhdx (virtual disk file location),

D:            \Hyper-V\Virtual Hard Disks\MOR-SVR-01_2_B44BE8C9-F890-4730-AEBF-F7B9CA428A39.vhdx (virtual disk file location).

--------------------

Error code: 207

Module: 83

LineInfo: 383ffdb092990dcb

Fields:  $module : hv_srv_vs_44421

Message: Failed to mount the volume snapshot.

--------------------

Error code: 33

Module: 7

LineInfo: e24f93d0b8d8c99e

Fields:  $module : hv_srv_vs_44421

Message: Failed to create volume snapshot.

--------------------

Error code: 50248

Module: 16

LineInfo: 3fec04e376b8a1f7

Fields:  $module : hv_srv_vs_44421

Message: Failed to add the volume to the snapshot.

--------------------

Error code: 9

Module: 0

LineInfo: 2aacb7b2ab852ac

Fields:  code : 2147754760, $module : hv_srv_vs_44421

Message: The specified object was not found.

 

One might useful information is that before ransomware attacking the server was install Acronis Backup Advanced v11.7.50230. After ransomware attacking we removed the corrupted Acronis and re-install Acronis Backup Advanced v11.7.44421. As we lost the Acronis account info and can not download the v11.7.50230 update, is that the cause of recovery failure?

Any suggestion would be greatly appreciated.

 

Anhang Größe
RescoverErr.JPG 228.62 KB
0 Users found this helpful
Support specialist
Beiträge: 0
Kommentare: 1414

#1

Hello Acronis Backup,

welcome to Acronis forums!

First, please share your email address via a Private Message so that we could retrieve your access to your Acronis Account, where you can download Acronis bootable media in ISO format.

Another variant for you is to download a trial recovery ISO media for Acronis Cyber Backup 12.5 and try recovering with it.

I also advise that you configure your target drive (virtual or physical) in accordance with the source drive structure.

Please keep at hand this detailed recovery guide https://kb.acronis.com/content/35681