PDA

View Full Version : W95.CIH/Chenobyl Virus


Gear up Shut up
22nd Apr 2000, 01:42
Anybody come across this one?

Had the pleasure of it but not sure if it is completely cleared.

Does anyone know how anti virus work? Do they duplicate clean files and leave the affected ones present but passified - this seems to be what has happened on my system but then it could always still be infected.

Thanks in advance.

ExSimGuy
22nd Apr 2000, 20:20
not too sure about this specific one but most of these "MS-Office" viruses add a macro that replicates itself to any other file of the same type (it may be Word, or Excel)

The "virus cleaners" try to remove the offending macro and then re-save. If they can't remove the macro they usually give you the option of deleting the virus. Either way, if the virus scanner detected the virus once and doesn't detect it after "cleaning", you can be pretty sure it has been "put to bed"

MS-Office programs have an option to alert you when you open a file if it has a macro, and give you the option of running the macro or not. That's a good way of ensuring these things can't replicate as most documents don't have macros. I have my computers set that way and I klnow which docs have genuine reasons for having a macro in them.

Of course, the real way is to have your anti-virus software right up to date; my secretary passed me a doc on floppy today that promptly activated my antivirus! Now he's gotta clean up his computer!

Be wary of ANY executable (.exe, .com, Word, Excel, HTML,) format files that you receive!!

Gear up Shut up
23rd Apr 2000, 15:23
Thanks ESG.

Most of your MS points I am aware of. All scans, of a product that is now spookily fully up to date,shows that all is clean.

I think I am just being an old woman(no sexist implications meant! :) ) and just needed someone like yourself to take me by the hand and say that it will all be alright! ;)