Uncleanable File

The Virus Scan Engine is unable to clean the following files:

Files infected with Trojans

Trojans are programs that perform unexpected or unauthorized, usually malicious, actions such as displaying messages, erasing files, or formatting disks. Trojans do not infect files, thus cleaning is not necessary.

Solution: OfficeScan uses the Virus Cleanup Engine and Virus Cleanup Template to remove Trojans.

Files infected with Worms

A computer worm is a self-contained program (or set of programs) able to spread functional copies of itself or its segments to other computer systems. The propagation usually takes place through network connections or email attachments. Worms are uncleanable because the file is a self-contained program.

Solution: Trend Micro recommends deleting worms.

Write-protected Infected Files

Solution: Remove the write-protection to allow OfficeScan to clean the file.

Password-protected Files

Includes password-protected compressed files or password-protected Microsoft Office files.

Solution: Remove the password protection for OfficeScan to clean these files.

Backup Files

Files with the RB0~RB9 extensions are backup copies of infected files. OfficeScan creates a backup of the infected file in case the virus/malware damaged the file during the cleaning process.

Solution: If OfficeScan successfully cleans the infected file, you do not need to keep the backup copy. If the computer functions normally, you can delete the backup file.

Infected Files in the Recycle Bin

OfficeScan may not remove infected files in the Recycle Bin because the system is running.

Solutions:

For computers running Windows 2000/XP/Server 2003 with NTFS File System, perform the following steps:

  1. Log on to the computer with Administrator privilege.

  2. Close all running applications to prevent applications from locking the file, which would make Windows unable to delete it.

  3. Open the command prompt, and type the following to delete the files:

    4. cd \

    cd recycled

    del *.* /S

    The last command deletes all files in the Recycle Bin.

  4. Check if the files were removed.

For computers running other operating systems (or NT platforms without NTFS), perform the following steps:

  1. Restart the computer in MS-DOS mode.

  2. Open a command prompt, and type the following to delete the files:

    3. cd \

    cd recycled

    del *.* /S

    The last command deletes all files in the Recycle Bin.

  3. Restart the computer in normal mode.

Infected Files in Windows Temp Folder or Internet Explorer Temporary Folder

OfficeScan may not clean infected files in the Windows Temp folder or the Internet Explorer temporary folder because the computer uses them. The files to clean may be temporary files needed for Windows operation.

Solution:

For computers running Windows 2000/XP/Server 2003 with NTFS File System, perform the following steps:

  1. Log on to the computer with Administrator privilege.

  2. Close all running applications to prevent applications from locking the file, which would make Windows unable to delete it.

  3. If the infected file is in the Windows Temp folder:

    1. Open the command prompt and go to the Windows Temp folder (located at C:\Windows\Temp for Windows XP/Server 2003 computers and at C:\WinNT\Temp for Windows NT/2000 computers by default).

    2. Type the following to delete the files:

    cd temp

    attrib -h

    del *.* /S

    The last command deletes all files in the Windows Temp folder.

  4. If the infected file is in the Internet Explorer temporary folder:

    1. Open a command prompt and go to the Internet Explorer Temp folder (located in C:\Documents and Settings\<Your user name>\Local Settings\Temporary Internet Files for Windows 2000/XP/Server 2003 computers by default).

    2. Type the following to delete the files:

      3. cd tempor~1

      attrib -h

      del *.* /S

      The last command deletes all files in the Internet Explorer temporary folder.

    3. Check if the files were removed.

For computers running other operating systems (or those without NTFS):

  1. Restart the computer in MS-DOS mode.

  2. If the infected file is in the Windows Temp folder:

    1. At the command prompt, go to the Windows Temp folder. The default Windows Temp folder in Windows XP/Server 2003 is C:\Windows\Temp. The default Windows Temp folder in Windows 2000 is C:\WinNT\Temp.

    2. Open the command prompt, and type the following to delete the files:

      3. cd temp

      attrib –h

      del *.* /S

      The last command deletes all files in the Windows Temp folder.

    3. Restart the computer in normal mode.

  3. If the infected file is in the Internet Explorer temporary folder:

    1. At the command prompt, go to the Internet Explorer temporary folder. The default Internet Explorer temporary folder in Windows 2000/XP/Server 2003 is C:\Documents and Settings\<Your user name>\Local Settings\Temporary Internet Files.

    2. Type the following commands:

      3. cd tempor~1

      attrib –h

      del *.* /S

      The last command deletes all files in the Internet Explorer temporary folder.

    3. Restart the computer in normal mode.