Virex: Handling an Infected File That Cannot Be Cleaned

If the scanner cannot clean an infected file, it renames the file to prevents its use. When a file is renamed, only the file extension (typically three letters) is changed. The following table shows the method of renaming.

For file extensions with more than three letters, the name is usually not truncated. For example, notepad.class becomes notepad.vlass. However, an infected file called water.vapor becomes water.vir.

File renaming conventions

Original Renamed Description

Not v?? v?? File extensions that do not start with v are renamed with v as the initial letter of the file
extension. For example, myfile.doc becomes myfile.voc.

v?? vir File extensions that start with v are renamed as .vir. For example, myfile.vbs becomes myfile.vir.
vir,
v01-v99 These files are recognized as already infected, and are not renamed again.

<blank> vir Files with no extensions are given the extension, .vir.

This information and more can be found at http://virexhelp.com/