 |
SFSCAN - CIH Virus
Scanner & Remover
Version
1.0.0.....this page last
updated
August 26, 1998 |
Virus
Information
Beta SCAN.EXE has been updated to include removal
of this virus. If possible, please use the BETASCAN.ZIP
download to retrieve this tool to remove the
virus.
Overview
Please
take the time to read our Non-Disclosure Agreement before downloading it.
This utility is designed to detect and clean
files which have been infected by the virus known
as "CIH", and identified by VirusScan
as "W32.CIH.SPACEFILLER" - a PE infector
virus.
Pre -
requisites for running Program
In order
to accurately detect and clean files from your
system, please reboot your computer from a clean
boot floppy and run this utility from floppy
disk.
It is preferable to replace infected files with
known clean backups however if you require a
remover (i.e. no clean backup is immediately
available), this utility can be used.
Installation
Instructions
None;
it is a single .EXE utility file.
Operating
Instructions
There
are 3 known variations of the virus, all are
identified as "SPACEFILLER". This
executable is designed to correct and remove the
virus from the header of PE files. Usage is:
SFScan [-s] [-a] [-c]
<dir/file name>
-s recursive search
-a test all files
-c clean infected files.
EXAMPLE:
To scan your entire hard drive to
detect but not clean, type in the following
command:
SFSCAN -S C:\
If you detected
the CIH virus in a file and need to clean it,
then you can use the -C option against that file
to clean it:
SFSCAN -S -C
C:\FILENAME.EXE
List
of Viruses addressed by the program
- W32.CIH.SPACEFILLER
- aliases:
- Win32/CIH
- W95/CIH
- CIHv1.2
- CIHv1.3
- CIHv1.4
Error
messages
In the event SFSCAN.EXE is unable
to clean a file, it is possible to remove the
virus using the latest version of the beta
SCAN.EXE. It has been updated to disinfect the
virus. Please download a copy of
BETASCAN.ZIP for the DOS command line version.
Please report
any errors to virus_research@nai.com.
Disclosure
This DOS
command line utility program has not been
approved by Quality Assurance and could cause
crashes on your machine(s). It has been
designed to help you address various issues and
should be used as recommended by your NAI or
AVERT representative.
Contact
For any
further questions please contact Virus Research
at virus_research@nai.com
