For example virus.exe could be renamed to. Virus writers sometimes rename an executable file with a PIF extension.

A PIF file is basically designed to hold information that will help an MS-DOS application know how to run in a Windows environment. For example the PIF file is one such extension. There are still some extensions which will not be visible so changes will need to be made in the registry. Once applied all extensions will now be visible. Next click the “View” tab, select “Show hidden files and folders” and also untick “Hide file extensions for known file types”. In Windows 2000/XP, we need to open Windows Explorer and select “Tools”… “Folder Options”. For us to view all extensions we need to make a couple to changes to our system. Windows by default hides known file type extensions. Using attrib with all the switches is the best way resetting a file and avoiding any errors. Windows Attrib command can be used to reset files as shown below. When system and hidden attributes has been set then these will need to be reset first otherwise resetting other attributes will fail. You might encounter files with the system, read only and hidden attributes set.

Malicious files quite often have their file attributes modified making it harder to detect. Making hidden files visible can sometimes be not as straight forward as expected and can be a bit confusing at times.

Attrib not resetting system file