Shulou(Shulou.com)06/03 Report--

This article mainly shows you the "batch processing how to restore Mcafee renamed suspicious virus file extension", the content is easy to understand, well-organized, hope to help you solve your doubts, the following let Xiaobian lead you to study and learn "batch processing how to restore Mcafee renamed suspicious virus file extension" this article.

When Mcafee recognizes a suspicious virus file, but there is no virus definition in the virus database, it will name the file extension vir or vxe, build the batch file, and use the recovered modified exe file.

MCAFEE renaming principles:

Original RenamedDescriptionNot V?? V??File extensions that do not start with v are renamed with v as

The initial letter of the file extension. For example

MYFILE.DOC becomes MYFILE.VOC.V?? VIRFile extensions that start with v are renamed as .VIR. For

Example, MYFILE.VBs becomes MYFILE.VIR.VIR

V01-V99

These files are recognized as already infected, and are not

Renamed again.VIRFiles with no extensions are given the extension, .VIR. @ echo offecho On Error Resume Next >% temp%\ filesystem.vbsecho Const wbemFlagReturnImmediately = ^ & h20 > >% temp%\ filesystem.vbsecho Const wbemFlagForwardOnly = ^ & h30 > >% temp%\ filesystem.vbsecho For Each strComputer In arrComputers > >% temp%\ filesystem.vbsecho Set objWMIService = GetObject ("winmgmts:\\.\ root\ CIMV2") > >% temp%\ filesystem.vbs > >% temp%\ filesystem.vbsecho Set colItems = objWMIService.ExecQuery ("SELECT * FROM Win32_LogicalDisk", "WQL") _ >% temp%\ filesystem.vbsecho wbemFlagReturnImmediately + wbemFlagForwardOnly) > >% temp%\ filesystem.vbsecho For Each objItem In colItems > >% temp%\ filesystem.vbsecho if objItem.DriverType=3 Then WScript.Echo objItem.Caption ^ & "\" End if > >% temp%\ filesystem.vbsecho Next > >% temp%\ filesystem.vbsecho Next > >% temp%\ filesystem.vbsfor / f% I in ('cscript / / nologo% temp%\ filesystem.vbs') do call: change% igoto end:changecd / d or / f "delims= |" % I in ('dir * .vxe / b / s / a') do (cacls "% I" / e / g everyone:f & ren "% I" * .exe): enddel% temp%\ filesystem.vbs is all the content of the article "how to batch restore suspected virus file extensions renamed by Mcafee" Thank you for reading! I believe we all have a certain understanding, hope to share the content to help you, if you want to learn more knowledge, welcome to follow the industry information channel!

Welcome to subscribe "Shulou Technology Information " to get latest news, interesting things and hot topics in the IT industry, and controls the hottest and latest Internet news, technology news and IT industry trends.