40
VirusScan
®
Command Line 5.20.0 Product Guide
Removing Infections
If the scanner detects a virus
4
If the scanner detects a virus
Viruses attack computer systems by infecting files — usually executable program files
or macros inside documents and templates. The scanner can safely remove most
common viruses from infected files.
However, some viruses are designed to damage your files. The scanner can move
these irreparably damaged or corrupted files to a quarantine directory or delete them
permanently to prevent further infection.
If the scanner cannot clean an infected file, it renames the file to prevent its use. When
a file is renamed, only the file extension (typically three letters) is changed. The
following table shows the methods of renaming.
For example, if an infected file called
BAD.COM
is found, the scanner attempts to
rename the file to
BAD.VOM
. However, if a file of that name already exists in the
directory, the scanner attempts to rename the file to
BAD.VIR
,
BAD.V01
, or
BAD.V02
,
and so on.
For file extensions with more than three letters, the name is usually not truncated. For
example,
NOTEPAD.CLASS
becomes
NOTEPAD.VLASS
. However, an infected file called
WATER.VAPOR
becomes
WATER.VIR
.
Removing a virus found in a file
If the scanner detects a virus in a file, it displays the path names of infected files and
takes the action you specified. For example:
If you selected
/MOVE
, the scanner automatically moves the infected files to the
specified quarantine directory.
If you selected
/CLEAN
, the scanner attempts to clean the file.
If you selected
/DEL
and this is an
.EXE
or
.COM
file, the scanner deletes the infected
file.
If you selected
/NORENAME
, the scanner does not rename the infected file.
Table 4-1 Renaming infected files
Original Renamed Description
Not
V??
V??
File extensions that do not start with
v
are renamed with
v
as
the initial letter of the file extension. For example,
MYFILE.DOC
becomes
MYFILE.VOC
.
V??
VIR
File extensions that start with
v
are renamed as
.
VIR
. For
example,
MYFILE.VBs
becomes
MYFILE.VIR
.
VIR
,
V01
-
V99
These files are recognized as already infected, and are not
renamed again.
<blank>
VIR
Files with no extensions are given the extension,
.
VIR
.