How to recover suspected virus file extensions renamed by Mcafee in batches
This article mainly shows you the "batch processing how to restore Mcafee renamed suspicious virus file extension", the content is easy to understand, well-organized, hope to help you solve your doubts, the following let Xiaobian lead you to study and learn "batch processing how to restore Mcafee renamed suspicious virus file extension" this article.
When Mcafee recognizes a suspicious virus file, but there is no virus definition in the virus database, it will name the file extension vir or vxe, build the batch file, and use the recovered modified exe file.
MCAFEE renaming principles:
Original RenamedDescriptionNot V?? V??File extensions that do not start with v are renamed with v as
The initial letter of the file extension. For example
MYFILE.DOC becomes MYFILE.VOC.V?? VIRFile extensions that start with v are renamed as .VIR. For
Example, MYFILE.VBs becomes MYFILE.VIR.VIR
V01-V99
These files are recognized as already infected, and are not
Renamed again.VIRFiles with no extensions are given the extension, .VIR. @ echo offecho On Error Resume Next >% temp%\ filesystem.vbsecho Const wbemFlagReturnImmediately = ^ & h20 > >% temp%\ filesystem.vbsecho Const wbemFlagForwardOnly = ^ & h30 > >% temp%\ filesystem.vbsecho For Each strComputer In arrComputers > >% temp%\ filesystem.vbsecho Set objWMIService = GetObject ("winmgmts:\\.\ root\ CIMV2") > >% temp%\ filesystem.vbs > >% temp%\ filesystem.vbsecho Set colItems = objWMIService.ExecQuery ("SELECT * FROM Win32_LogicalDisk", "WQL") _ >% temp%\ filesystem.vbsecho wbemFlagReturnImmediately + wbemFlagForwardOnly) > >% temp%\ filesystem.vbsecho For Each objItem In colItems > >% temp%\ filesystem.vbsecho if objItem.DriverType=3 Then WScript.Echo objItem.Caption ^ & "\" End if > >% temp%\ filesystem.vbsecho Next > >% temp%\ filesystem.vbsecho Next > >% temp%\ filesystem.vbsfor / f% I in ('cscript / / nologo% temp%\ filesystem.vbs') do call: change% igoto end:changecd / d or / f "delims= |" % I in ('dir * .vxe / b / s / a') do (cacls "% I" / e / g everyone:f & ren "% I" * .exe): enddel% temp%\ filesystem.vbs is all the content of the article "how to batch restore suspected virus file extensions renamed by Mcafee" Thank you for reading! I believe we all have a certain understanding, hope to share the content to help you, if you want to learn more knowledge, welcome to follow the industry information channel!
