| SFSCAN - CIH Virus Scanner & Remover Version 1.0.0.....this page last updated August 26, 1998
Virus Information *** Update *** Beta SCAN.EXE has been updated to include removal of this virus. If possible, please use the BETASCAN.ZIP download to retrieve this tool to remove the virus. Overview Please take the time to read our Non-Disclosure Agreement before downloading it. This utility is designed to detect and clean files which have been infected by the virus known as "CIH", and identified by VirusScan as "W32.CIH.SPACEFILLER" - a PE infector virus. Pre - requisites for running Program In order to accurately detect and clean files from your system, please reboot your computer from a clean boot floppy and run this utility from floppy disk. It is preferable to replace infected files with known clean backups however if you require a remover (i.e. no clean backup is immediately available), this utility can be used. Installation Instructions None; it is a single .EXE utility file. Operating Instructions There are 3 known variations of the virus, all are identified as "SPACEFILLER". This executable is designed to correct and remove the virus from the header of PE files. Usage is: SFScan [-s] [-a] [-c] <dir/file name> -s recursive search -a test all files -c clean infected files. EXAMPLE: To scan your entire hard drive to detect but not clean, type in the following command: SFSCAN -S C:\ If you detected the CIH virus in a file and need to clean it, then you can use the -C option against that file to clean it: SFSCAN -S -C C:\FILENAME.EXE List of Viruses addressed by the program W32.CIH.SPACEFILLER aliases: Win32/CIH W95/CIH CIHv1.2 CIHv1.3 CIHv1.4 DOWNLOAD NOW Error messages In the event SFSCAN.EXE is unable to clean a file, it is possible to remove the virus using the latest version of the beta SCAN.EXE. It has been updated to disinfect the virus. Please download a copy of BETASCAN.ZIP for the DOS command line version. Please report any errors to virus_research@nai.com. Disclosure This DOS command line utility program has not been approved by Quality Assurance and could cause crashes on your machine(s). It has been designed to help you address various issues and should be used as recommended by your NAI or AVERT representative. Contact For any further questions please contact Virus Research at virus_research@nai.com
© 1998, Network Associates, Inc. and its affiliated Companies. All Rights Reserved.