Norton AntiVirus KILL_CIH.EXE Tool

Introduction

The KILL_CIH tool is designed to safely detect and remove all known strains
of the W95.CIH virus (known strains as of August 3rd, 1998) from memory under
Windows 95 and Windows 98 (the W95.CIH virus cannot infect Windows NT
systems). If the tool is run before the virus has infected the system, it
will also "inoculate" the computer's memory to prevent the W95.CIH virus from
infecting the system until the next system reboot.

*NOTE* If you are already infected with the W95.CIH virus, run the KILL_CIH
tool first before attempting to update your anti-virus definitions or scan
your system. If you attempt to scan with an anti-virus product without first
running this tool, you run the risk of causing your infection to spread.
Once you have used this tool, you can safely update your Norton AntiVirus
definitions and scan your machine.

The KILL_CIH tool will not detect or remove the W95.CIH virus from files; it
will only disable the virus in memory so that an anti-virus program can remove
the infection without inadvertently spreading the virus.  You can obtain a
freeware version of Norton AntiVirus to detect and remove the virus from files
on the Symantec web site at:

        www.symantec.com/nav/navc.html

This CIH removal tool can be run from either the DOS command line or from a
login script, allowing an administrator to automate the disinfection process.
This means that an administrator does not have to go to each workstation on
their network and reboot from a clean floppy in order to clean the computer.
After using this tool, you should update your virus definitions and then start
a complete scan of the computer with an anti-virus program such as Norton
AntiVirus.  This will eliminate the virus and repair any damaged files.  The
tool itself is designed to avoid infection by the virus and can safely be run
without becoming infected if the virus is already resident on a computer.


W95.CIH Background

CIH is a virus that infects 32-bit Windows 95/98/NT executable files.  When
an infected program is run, the virus will infect the computer's memory.  CIH
then infects new files when they are opened.  Some variants of the virus
activate on April 26th or June 26th, while other variants will activate on
the 26th of every month.  This virus will attempt to modify or corrupt certain
types of Flash BIOS, software that initializes and manages the relationships
and data flow between the system devices, including the hard drive, serial
and parallel ports and the keyboard.  By overwriting part of the BIOS program,
the virus can keep a computer from starting up when the power is turned on.

The virus infects by first looking for empty, unused spaces in the file; then,
it breaks itself up into smaller pieces, and hides in these unused spaces.
Norton AntiVirus is able to repair an infected file by looking for these
viral pieces and removing them.

Usage

To use the KILL_CIH tool, use any *one* of the following methods:

        1. Double click on the file from your desktop or Explorer.
        2. Run KILL_CIH.EXE from a DOS box.
        3. Use the "Run" command from the Windows Start menu.
        4. Place the KILL_CIH.EXE in a standard login script.

        After running this tool, update your virus definitions and
        initiate a scan with Norton AntiVirus or another anti-virus product
        that is capable of removing the W95.CIH virus from files.

The KILL_CIH.EXE program requires no command line arguments.  It will display
one of several different messages upon completion:


  "The W95.CIH virus was found in memory. The W95.CIH virus has been
   successfully disabled. You can now run the Norton AntiVirus to
   remove any infections from files."

        This message is displayed if any strain of the W95.CIH virus is found
        in the computer's memory.  The tool has disabled the virus in memory
        and will prevent it from causing damage to the system or infecting any
        additional files.  At this point, it is safe to run Norton AntiVirus
        or another anti-virus program to remove the virus from the system.

  "The W95.CIH virus was not found in memory."

        This message is displayed if no known strains of the W95.CIH virus are
        found in memory.  The tool has inoculated the computer and will
        prevent the virus from infecting system memory if an infected file is
        run during the remainder of the computer session (until reboot). At
        this point, it is safe to run Norton AntiVirus or another anti-virus
        program to remove the virus from the system.

  "Warning: This Windows NT system cannot be infected by the W95.CIH virus."

        This message will be displayed if the tool is used under Windows NT.
        There is no harm in doing this and the program will exit normally
        after displaying this message.


Troubleshooting

If you have any problems with this tool, please contact Symantec technical
support for more details.