my comps are infected with the CIH virus what to do ??

[skywalker[TSG]]

hmm i discovered that my server had the CIH virus this means that all me other comps also have it how do i delete it ? i cant delete it from windows since explorer.exe is infected and i cant fix it because the file is in use

[socalgal]

oh no skywalker. http://www.sysopt.com/forum/frown.gif

Here is a c&p of a post of mine from a few months ago relating to CIH.

I did this several months ago when CIH was discovered. You should install and use the KILL TOOL before you initiate a virus scan (please read *NOTE* below). This following is the from Symnantec(Norton AV) site.
www.symantec.com/avcenter/kill_cih.html (http://www.symantec.com/avcenter/kill_cih.html)

Information and Protection for W95.CIH (Chernobyl) virus: KILL_CIH.EXE Tool

Introduction


The KILL_CIH tool is designed to safely detect and remove all known strains of the W95.CIH (Chernobyl) virus (known strains as of August 3rd, 1998) from memory under Windows 95 and Windows 98 (the W95.CIH virus cannot infect Windows NT systems). If the tool is run before the virus has infected the system, it will also "inoculate" the computer's memory to prevent the W95.CIH virus from infecting the system until the next system reboot.

*NOTE* If you are already infected with the W95.CIH virus, run the KILL_CIH tool first before attempting to update your anti-virus definitions or scan your system. If you attempt to scan with an anti-virus product without first running this tool, you run the risk of causing your infection to spread. Once you have used this tool, you can safely update your Norton AntiVirus definitions and scan your machine.

The KILL_CIH tool will not detect or remove the W95.CIH virus from files; it will only disable the virus in memory so that an anti-virus program can remove the infection without inadvertently spreading the virus.

Here's updated info regarding CIH that will give you more info.

http://www.symantec.com/search/iatoc

I hope this helps!



[This message has been edited by socalgal (edited 08-11-99).]

[ANTONIO E GUERRA]

Skywalker, I will send a prayer for you and all your computers. That virus is so vicious and unmerciful. Norton is your best bet and the killch is the only thing I know it will fix the problem. Since the computer is in a network, try to fix the problem in the server and then fix all the computers from there. Good luck! That is the most harmful virus I have seen in many years.

[skywalker[TSG]]

hmm i have some friends that know some things about this virus im gona take all my comps to them and let the fix it for me hmm i wonder if i can fit 7comps all in full towercases in the back of my car =/

thanks socalgal for your support but that is to much work for me ive never been that good with software im a hardware junkie so =(

oh well if they cant fix it i guess im gona kill my self

[socalgal]

Good luck skywalker and don't kill yourself because we'd miss you http://www.sysopt.com/forum/wink.gif

[Vidfreek]

What exactly does this virus do, I think I might have it but I'm not sure about it. I have been having problems with my computer for about a week and my old 10 gig maxtor went bad because of something. Just kept freezing, not much at first, but then it got worse untill I couldnt even boot up anymore. I replaced the hard drive and the same thing is starting to happen again. Is this what you are talking about, does the CIH do this. The only way that it could happend again is if the virus was in memory right? Since I replaced the hard drive? Please help, I got the files you were talking about and Im going to try it when I get home from work.

Thanks,

Vidfreek

[skywalker[TSG]]

hmm i have formated the drives on the comps and installed win2k i hope this helps well only time can tell