
SFSCAN.EXE v1.0.0 -  W32.CIH.SPACEFILLER virus scanner and remover
 - July 24, 1998

This stand-alone utility will detect and remove the virus known as W32.CIH.SPACEFILLER. This virus infects PE files within Windows 95 thru Windows 98. 

It is recommended that a clean boot to a floppy disk, and then run this utility from a floppy to identify and remove this.

There are 3 known variations of the virus, all are identified as "SPACEFILLER". This executable is designed to correct and remove the virus from the header of PE files. Usage is:

SFScan [-s] [-a] [-c] <dir/file name>
-s recursive search
-a test all files
-c clean infected files.
EXAMPLE:
The standard output for the remover given the command SFSCAN C:\INFECTED with 2 infected files in that directory:
SFSCAN -S -C C:\INFECTED
SFScan v1.0.0 W32.CIH.SPACEFILLER virus scanner.
Copyright (c) 1998 Network Associates, Inc. All rights reserved.

c:\infected\DS_95_16.EXE is infected.
Virus removed from c:\infected\DS_95_16.EXE.

7 file(s) processed.
1 file(s) infected.
1 file(s) cleaned.
If the file has been cleaned by this process already, running SFSCAN.EXE will confirm the infection appears removed:
SFSCAN v1.0.0 W32.CIH.SPACEFILLER virus remover.
Copyright (c) 1998 Network Associates, Inc. All rights reserved.

7 file(s) processed.
0 file(s) infected.
0 file(s) cleaned.
Error messages
Please report any errors to virus_research@nai.com <mailto:virus_research@nai.com>.
List of Viruses addressed by the program 
W32.CIH.SPACEFILLER  a.k.a. CIH v1.2, v1.3 & v1.4 
Contact
For any further questions please contact Virus Research at virus_research@nai.com <mailto:virus_research@nai.com> 
 1998, Network Associates, Inc. and its affiliated Companies. All Rights Reserved. 