CIH virus nuisance

[Crass1]

Hello. Well i've been hit with the w95.CIH virus. i've tried the kill_cih.exe tool then have run my McAfee virusscan, but the virus still exists on my system. My computer is more or less still operational, although internet explorer and outlook are very unstable. Are there any other ideas of how to remove this virus?

[phantom713]

is the virus an actual executable that you can find? If it is I'd go into DOS rename the file then delete it.

renaming it will trick windows in most cases to let you delete a file that is in use.

C:\>cd #temp

C:\#temp>dir
Volume in drive C has no label.
Volume Serial Number is 8CCE-A1AC

Directory of C:\#temp

01/07/2002 01:22p <DIR> .
01/07/2002 01:22p <DIR> ..
01/07/2002 01:21p 0 deleteme.txt
1 File(s) 0 bytes
2 Dir(s) 8,099,753,984 bytes free

C:\#temp>ren deleteme.txt deleted.txt

C:\#temp>del deleted.txt

C:\#temp>dir
Volume in drive C has no label.
Volume Serial Number is 8CCE-A1AC

Directory of C:\#temp

01/07/2002 01:44p <DIR> .
01/07/2002 01:44p <DIR> ..
0 File(s) 0 bytes
2 Dir(s) 8,099,659,776 bytes free

C:\#temp>

[wizofid]

you may also seach for fixes - gibson research is one place -

you may wish to back your stuff up and then format c: and reinstall it completely -

too many times holes are left - especially in the doze.

wiz

[RampageIII]

Maybe try an online scan from Symantec? (http://security1.norton.com/ssc/home.asp?j=1&langid=us&venid=sym&plfid=20&pkj=RNHOLSIVFWMFKPXKBQW)


Look around the site for other suggestions. Good Luck :)








***viBe***
Why not put your PC's idle time to good use by downloading the seti@home client HERE (http://setiathome.ssl.berkeley.edu/windows.html) and then joining the Sysopt.com Users 2002 Team HERE (http://setiathome.ssl.berkeley.edu/cgi-bin/cgi?cmd=team_lookup&name=Sysopt.com+Users+2002)

[Crass1]

Thanks for the replys. After trying different tools such as McAfee, a cleancih.exe file i found, and a couple of different online scans, with no success, i finally tried Norton's scan engine in dos. It seemed to have fixed the problem. I guess only time will tell if the problem is really gone!

[RayH]

That's one virus that's no joke. I believe it only executes on the 26th of the month. But unlike most viruses, it destroys hardware!

[G]

I have a unique, but very small program that I can send to you. Send me a PM, if you do, with your email address.

G

[Crass1]

I just wanted to make an update: Its been a week and the virus is still non-existant, and all my files are intact. A good place to go (Thanks G), to find a free program to attack the virus is
http://grc.com/fix-cih.htm

cheers.

[G]

Well done Crass1 for getting back to us. It helps a great deal when the requester is kind enough to complete their post, when possible, with a successful conclusion or a word of warning to potential victims.

All the best,
G

[Comage]

RampageIII: The virus scan doesn't help you to clean out any existing viruses found on your system. You still have to obtain a copy of an anti-virus software to clean out any viruses. Just FYI, and for everybody else who is reading this. :)

[RampageIII]

I agree, Comage, you should have an anti-virus installed. I just suggested it as another resource. ;)

Besides, they do have suggestions for cleaning viruses and worms at the site.

But again, you have to have some virus protection in place on the computer and constantly updated. Especially now when there seems to be so many new virues every day!






Why not put your PC's idle time to good use by downloading the seti@home client HERE (http://setiathome.ssl.berkeley.edu/windows.html) and then joining the Sysopt.com Users 2002 Team HERE (http://setiathome.ssl.berkeley.edu/cgi-bin/cgi?cmd=team_lookup&name=Sysopt.com+Users+2002)

[Comage]

Hehe... I don't have any anti-virus package installed on my computer. Actually, I'm not even worried about any computer virus infecting my computer! :P

I know what I download, and I know what comes and goes around my computer. So, I can be 100% sure that no virus will enter my PC. Even if the PC's infected, I'd know it, and would be able to remove it manually. :)

I guess self-discipline is very important. It saves you a lot of money from purchasing anti-virus software packages. :)

[RampageIII]

Best of Luck! :D






Why not put your PC's idle time to good use by downloading the seti@home client HERE (http://setiathome.ssl.berkeley.edu/windows.html) and then joining the Sysopt.com Users 2002 Team HERE (http://setiathome.ssl.berkeley.edu/cgi-bin/cgi?cmd=team_lookup&name=Sysopt.com+Users+2002) :cool: