How does disinfection work?
The best way to disinfect a file is to erase it, and restore from a clean backup. Failing that, disinfecting software will contain a description of the specific viral operation of a given viral program, so that the infection process can be reversed. You have to know what a virus changes, and how, in order to change the object back to the way it was. Scanner developers have to examine the virus code, so they have an advantage in knowing how the virus works, and it is scanners which usually have disinfection modules. In some cases the file or disk sector cannot be returned to its original state by this method. Viruses that overwrite sections of code leave no means of recovering the original material.
