Help CIH virus 
Author Message
 Help CIH virus

I somehow managed to get the CIH virus in the last couple weeks and only
discovered I had it last night.  Everquest would repeatedly repatch and tell
me to restart, I went to the sony official sight and to my dismay found out
those were the signs of the CIH virus.  I did have an anti virus at the time
but prmptly downloaded 4 of them, Norton, Mcafee,  Protector plus and
F-security.  Problem is 3 of them don't work.  When I attempt to install I
get "An unexpected error has occured with an invalid attachment. Please make
note of this error.. (error 301, 0)"  or I get can't load at the desired
address and is not relocatable. Contact your vendor to get a version that is
compatible with this version of windows".  Take into account I'm 100% sure
that I got the win 98 version of the programs.

The only one that would install is protector plus and it found the CIH virus
and cured over 300 files infected.  Problem is Run32dll.exe and several
other important exes are infected with CIH and protector plus cant seem to
cure them.

I tried CleanCIH dos utility and it seems to read through everyone of my
300+ exe files and it says nothing is infected.  I tried Nortons specific
CIH utility but in dos I get the message this program cannot be run in dos
and in windows a dos prompt window pops up and immidiatly dissapears when I
run the program.

Now I cant seem to install any other anti virus programs and Protector plus
isnt killin the stupid thing.  Anyone have any ideas?  I know CIH will come
into effect the 26th of each month and I've set my clock back so as not to
be effected, but it still messes up my comp.

Sorry about the length I just wanted to get all the details down.
Thank you so much for your help in advance guys.



Fri, 12 Mar 2004 07:30:02 GMT  
 Help CIH virus
[posted and mailed]


Quote:
> I somehow managed to get the CIH virus in the last couple weeks and only
> discovered I had it last night.  Everquest would repeatedly repatch and
tell
> me to restart, I went to the sony official sight and to my dismay found
out
> those were the signs of the CIH virus.  I did have an anti virus at the
time
> but prmptly downloaded 4 of them, Norton, Mcafee,  Protector plus and
> F-security.  Problem is 3 of them don't work.  When I attempt to install I
> get "An unexpected error has occured with an invalid attachment. Please
make
> note of this error.. (error 301, 0)"  or I get can't load at the desired
> address and is not relocatable. Contact your vendor to get a version that
is
> compatible with this version of windows".  Take into account I'm 100% sure
> that I got the win 98 version of the programs.

> The only one that would install is protector plus and it found the CIH
virus
> and cured over 300 files infected.  Problem is Run32dll.exe and several
> other important exes are infected with CIH and protector plus cant seem to
> cure them.

> I tried CleanCIH dos utility and it seems to read through everyone of my
> 300+ exe files and it says nothing is infected.  I tried Nortons specific
> CIH utility but in dos I get the message this program cannot be run in dos
> and in windows a dos prompt window pops up and immidiatly dissapears when
I
> run the program.

> Now I cant seem to install any other anti virus programs and Protector
plus
> isnt killin the stupid thing.  Anyone have any ideas?  I know CIH will
come
> into effect the 26th of each month and I've set my clock back so as not to
> be effected, but it still messes up my comp.

> Sorry about the length I just wanted to get all the details down.
> Thank you so much for your help in advance guys.

Try downloading f-prot from www.complex.is - you can use the DOS version
with a bootable floppy disk to clean your computer.

If you are unsure how to make it work in this way you can download a routine
I wrote that is designed to use f-prot to clean nimda but will also work
with most other viruses including CIH:

* get 2  blank disks, make them bootable (put each one into the a: drive in
turn, open a dos prompt and type sys a: for the first one, remove it, put in
the 2nd and type sys a: again and voila! 2 bootable floppies!).

* Then download nimdanuke.zip from the ftp site ftp://www.lutonsfc.ac.uk -
It's based on f-prot and kills most known viruses dead including CIH.

*Open nimdanuke.zip once it's downloaded and you'll find 2 zip files in
there labeled 'disk1' and 'disk2'.

* Extract the contents of 'disk1.zip' to the first bootable floppy we made
in the last paragraph, and the contents of 'disk2.zip' to the second
bootable floppy.

* Read the instructions in the Read_Me.txt file on how to use the 2 disks.
You should read parts 2 & 3 which tell you more about making and using the
floppies.

--
--
Robert Moir, Microsoft MVP
To search the MS Knowledge base use the link below:
http://support.microsoft.com/support/search/c.asp?PSL=1
My Homepage - http://www.robertmoir.co.uk
** Emailed questions will not be answered **



Thu, 11 Mar 2004 20:31:36 GMT  
 Help CIH virus
Yesterday was October 16th and SirCam (I did not know it was a virus at the
time)  erased all the files on the hard drive on our server.  I had a day
old full tape backup so I formatted the hard drive installed Win98 SE
restored my tape and all is well. But is it?  Tonight I came home and looked
up a files that was in my recycle bin after  I had deleted all the other
files and found out that it was a virus that has a payload that goes into
effect on 10/16 and year. Now my concern is that it has spread to other
shares on our network.
Will the disks you describe below clean out w32.sircam?


Quote:
> [posted and mailed]



> > I somehow managed to get the CIH virus in the last couple weeks and only
> > discovered I had it last night.  Everquest would repeatedly repatch and
> tell
> > me to restart, I went to the sony official sight and to my dismay found
> out
> > those were the signs of the CIH virus.  I did have an anti virus at the
> time
> > but prmptly downloaded 4 of them, Norton, Mcafee,  Protector plus and
> > F-security.  Problem is 3 of them don't work.  When I attempt to install
I
> > get "An unexpected error has occured with an invalid attachment. Please
> make
> > note of this error.. (error 301, 0)"  or I get can't load at the desired
> > address and is not relocatable. Contact your vendor to get a version
that
> is
> > compatible with this version of windows".  Take into account I'm 100%
sure
> > that I got the win 98 version of the programs.

> > The only one that would install is protector plus and it found the CIH
> virus
> > and cured over 300 files infected.  Problem is Run32dll.exe and several
> > other important exes are infected with CIH and protector plus cant seem
to
> > cure them.

> > I tried CleanCIH dos utility and it seems to read through everyone of my
> > 300+ exe files and it says nothing is infected.  I tried Nortons
specific
> > CIH utility but in dos I get the message this program cannot be run in
dos
> > and in windows a dos prompt window pops up and immidiatly dissapears
when
> I
> > run the program.

> > Now I cant seem to install any other anti virus programs and Protector
> plus
> > isnt killin the stupid thing.  Anyone have any ideas?  I know CIH will
> come
> > into effect the 26th of each month and I've set my clock back so as not
to
> > be effected, but it still messes up my comp.

> > Sorry about the length I just wanted to get all the details down.
> > Thank you so much for your help in advance guys.

> Try downloading f-prot from www.complex.is - you can use the DOS version
> with a bootable floppy disk to clean your computer.

> If you are unsure how to make it work in this way you can download a
routine
> I wrote that is designed to use f-prot to clean nimda but will also work
> with most other viruses including CIH:

> * get 2  blank disks, make them bootable (put each one into the a: drive
in
> turn, open a dos prompt and type sys a: for the first one, remove it, put
in
> the 2nd and type sys a: again and voila! 2 bootable floppies!).

> * Then download nimdanuke.zip from the ftp site ftp://www.lutonsfc.ac.uk -
> It's based on f-prot and kills most known viruses dead including CIH.

> *Open nimdanuke.zip once it's downloaded and you'll find 2 zip files in
> there labeled 'disk1' and 'disk2'.

> * Extract the contents of 'disk1.zip' to the first bootable floppy we made
> in the last paragraph, and the contents of 'disk2.zip' to the second
> bootable floppy.

> * Read the instructions in the Read_Me.txt file on how to use the 2 disks.
> You should read parts 2 & 3 which tell you more about making and using the
> floppies.

> --
> --
> Robert Moir, Microsoft MVP
> To search the MS Knowledge base use the link below:
> http://support.microsoft.com/support/search/c.asp?PSL=1
> My Homepage - http://www.robertmoir.co.uk
> ** Emailed questions will not be answered **



Mon, 05 Apr 2004 07:05:44 GMT  
 
 [ 3 post ] 

 Relevant Pages 

1. PLease Help : CIH Virus

2. Advice on CIH Virus.

3. w95.cih virus

4. CIH Virus

5. W95.cih help !!

6. Help me get rid of this virus post has a virus in the post

7. Virus Boot - Boot virus - help

8. VIRUS VIRUS VIRUS

9. nyb virus how do i get it out HELP HELP

10. Off topic: CIH

11. CIH AND DATA RECOVERY

12. Off topic: CIH - Data recovery possible

 

 
Powered by phpBB® Forum Software