Virus in memory

Steve-182

Something weird happened yesterday - a message came up on my screen saying that the W95/CIH 10-xx virus was found in memory. I've since found out that this is the Chernobyl (sp?) virus and that August 2nd was a known day for its "Warhead" to fire. Sounds fun. I've since run a Kill-CIH.exe file off the net (i think its was Norton's website) and swept the PC and no files were infected - as best i can tell. I have Avast! and Sophos and both are up to date and active.

My question is this....how can you tell what's lurking in the memory of the PC, and is there a file to run that will kill anything that might be hiding there?

Help appreciated.

Wombat

The only way I know of is to hope that the anti-virus program writers are up to date with their detection rules. The problem with these "delayed action" viruses is that no-one probably knows about them until they're activated.

It's not a bad idea to do a regular scan with one of the free online scanners, like Panda:

http://www.pandasoftware.com/products/activescan/com/activescan_principal.htm

Apart from that the other defence is to control as much as possible what comes into your PC using free software like Ad-aware, Spybot, Pest Patrol, BHO Demon and Cookiewall and keeping your anti-virus and Firewall software up to date, regularly checking for the latest updates.

boogiemaster

I just took out my memory and the battery from my bios just in case.
I left them out for half an hour and it cured mine.
I had a virus that locked me out of my own system once, that was a pain in the !!!!!!!!!

heatherw_01

Just to let you know that you should only have 1 antivirus on your machine as they can conflict with each other.

criminal_smile

heatherw_01 wrote:

Just to let you know that you should only have 1 antivirus on your machine as they can conflict with each other.

Can be the case with certain AV programs, but I'm running Avast and AVG on mine, and absolutely no conflicts. Quite a lot of other people on the boards also seem to do this.

Genghis

I think the main date to worry about with CIH is the date of Chernobyl (some time in April?) but sounds like you're pretty much clean if none of your antivirus software picks it up.

With CIH, it attaches itself to every executable that runs (I think!) so explorer.exe etc will be infected. If you're still worried, perhaps a virus scanner that can be loaded in DOS before Windows starts?

I'd make sure you're CIH free though cuz its not very pleasant

Browntoa

found this removal tool for it to make sure it has gone

http://securityresponse.symantec.com/avcenter/venc/data/kill_cih.html

streetscholar

yep http://www.pandasoftware.com these guys do a good job at spyware/virus detection and prevention

Steve-182

thanks to all, i've run a DOS based scan, and several other scan, and the kill-cih file, so it should be fine. Fingers crossed !!!

Genghis

At least we'll know what happened if you disappear next April