• Comments (0)
• Report
• Print
• Tell a Friend
• Screenshots

KILL_CIH.EXE 1.0 is designed to safely detect and remove all known strains of the W95.CIH (Chernobyl) virus (known strains as of August 3rd, 1998) from memory.

This CIH removal tool can be run from either the DOS command line or from a login script, allowing an administrator to automate the disinfection process. This means that an administrator does not have to go to each workstation on their network and reboot from a clean floppy in order to clean the computer. After using this tool, you should update your virus definitions and then start a complete scan of the computer with an anti-virus program such as Norton AntiVirus. This will eliminate the virus and repair any damaged files. The tool itself is designed to avoid infection by the virus and can safely be run without becoming infected if the virus is already resident on a computer.

CIH is a virus that infects 32-bit Windows 95/98/NT executable files. When an infected program is run, the virus will infect the computer's memory. CIH then infects new files when they are opened. Some variants of the virus activate on April 26th or June 26th, while other variants will activate on the 26th of every month. This virus will attempt to modify or corrupt certain types of Flash BIOS, software that initializes and manages the relationships and data flow between the system devices, including the hard drive, serial and parallel ports and the keyboard. By overwriting part of the BIOS program, the virus can keep a computer from starting up when the power is turned on.

The virus infects by first looking for empty, unused spaces in the file; then, it breaks itself up into smaller pieces, and hides in these unused spaces. Norton AntiVirus is able to repair an infected file by looking for these viral pieces and removing them.