McAfee VCLCDE-AA-DA Product Guide - Page 40

VirusScan® Command Line 5.20.0 Product Guide 4 Removing Infections If the scanner detects a virus If the scanner detects a virus Viruses attack computer systems by infecting files - usually executable program files or macros inside documents and templates. The scanner can safely remove most common viruses from infected files. However, some viruses are designed to damage your files. The scanner can move these irreparably damaged or corrupted files to a quarantine directory or delete them permanently to prevent further infection. If the scanner cannot clean an infected file, it renames the file to prevent its use. When a file is renamed, only the file extension (typically three letters) is changed. The following table shows the methods of renaming. Table 4-1 Renaming infected files Original Renamed Description Not V?? V?? File extensions that do not start with v are renamed with v as the initial letter of the file extension. For example, MYFILE.DOC becomes MYFILE.VOC. V?? VIR File extensions that start with v are renamed as .VIR. For example, MYFILE.VBs becomes MYFILE.VIR. VIR, V01-V99 These files are recognized as already infected, and are not renamed again. VIR Files with no extensions are given the extension, .VIR. For example, if an infected file called BAD.COM is found, the scanner attempts to rename the file to BAD.VOM. However, if a file of that name already exists in the directory, the scanner attempts to rename the file to BAD.VIR, BAD.V01, or BAD.V02, and so on. For file extensions with more than three letters, the name is usually not truncated. For example, NOTEPAD.CLASS becomes NOTEPAD.VLASS. However, an infected file called WATER.VAPOR becomes WATER.VIR. Removing a virus found in a file If the scanner detects a virus in a file, it displays the path names of infected files and takes the action you specified. For example: „ If you selected /MOVE, the scanner automatically moves the infected files to the specified quarantine directory. „ If you selected /CLEAN, the scanner attempts to clean the file. „ If you selected /DEL and this is an .EXE or .COM file, the scanner deletes the infected file. „ If you selected /NORENAME, the scanner does not rename the infected file. 40