Hello everyone, in this video I'll be taking another look at the CIH virus,
and methods that can be used to remove it from an infected computer.
If you've followed my channel for a significant amount of time
you've probably seen my CIH video, it's currently the most viewed video on my channel.
In this video I demonstrated the destructive capabilities of CIH,
following it as it infected my PC and subsequently destroyed the data on the hard drive and the BIOS,
rendering the computer unbootable.
Some of you thought I got a little too exited during this destruction,
however, I feel it's one of the best videos I've made to date, and that excitement is justified.
There's not much I feel that can be improved upon in the original video,
everything worked on the first try, and the computer ended up dead.
Considering there was not a second chance to re-record the virus after it worked
and overwrote the BIOS, the fact that everything went so smoothly on the first take
made the video come together brilliantly.
But if your chip-set didn't support the exploit CIH used to overwrite the BIOS,
or if you had the 'BIOS Write-Protect Jumper' enabled on your motherboard,
your computer would survive April 26th, but your data would be lost
as your computer would fail to boot, with a missing operating system, or similar error.
But all is not as it seems as an actuality CIH overwrites the first Megabyte of all hardrives,
destroying the partition tables in the file allocation table,
but leaves your data very much intact--
it's just a matter of accessing it.
Before we go about repairing the damage CIH causes on an infected system,
i'd like to address one question that comes up every now and then.
What happens when you run CIH on a virtual machine?
Does the host's BIOS deleted too?
The answer is no.
When a VM with CIH is trashed, only the hard drive corruption payload is apparent and your main PC's BIOS is safe.
Now for the fun stuff,
here we have a PC running Windows 98 SE, a prime target for CIH.
This is my old Gateway Computer with a Pentium 4 Processor
so it's not vulnerable to the BIOS deletion payload.
As we infect it with CIH, let's take a look at how the virus has the potential
to spread very quickly throughout a user's system,
considering we've just unleashed CIH on this computer,
let's perform a common task one might expect after running an unknown executable
A Virus Scan!
Seems innocuous enough...
However keep in mind that CIH infects EXE files as they are accessed,
which could be anything from opening a file to simply reading or copying it.
Since a virus scan is essentially reading all files on the drive to check them for virus signatures,
CIH utilizes this to hit every EXE picked up by the virus scanner,
leading to a very thoroughly infected system.
When we change the date to the 26th and run any program at all,
we see the familiar 'Blue Screen of Death' that lets us know that our computer is trashed.
Our computer can still boot though, but only far enough to tell us that the operating system is missing.
Using a 'Windows Boot Disk', let's take a look at a tool called "Fix-CIH".
That does exactly what it says on the tin.
When run, "Fix-CIH" greets the user with a series of detailed instructions explaining
how the tool will attempt to fix their hard drive,
or if it will avoid attempting reconstruction due to the way the drive was set up.
It's a delicate process but since this computer was formatted as FAT-32,
the tool gives us the go-ahead to attempt a repair on the drive.
It also notifies us, in bright red letters, that this tool does not remove the virus from the drive,
it merely un-does the destruction to allow you to boot into your massively infected system.
Once the instructions are read, the scan itself takes about seven minutes
on a one Gigabyte hard drive.
When I originally started work on this video,
I had an 80GB hard drive on the machine,
but rather than record a monitor for 10 hours straight, I decided to swap hard drive for the sake of making this
video easier to watch for everyone.
Once the tool completes its work, it exits to the DOS prompt and tells us to restart the computer.
First things first though, changing the date FAR away from the 26th of April is necessary to avoid
immediately nuking the machine again once Windows boots up.
"Fix-CIH" was a success; The machine boots into Windows!
Now to go about removing the infection and restoring this PC to Tip-Top SHAPE!
Symantec released a handy tool called "Kill CIH", which removes CIH from memory,
allowing you to run anti-virus software without infecting it.
Which would render the whole thing an exercise in futility.
This tool works from the command line and unloads CIH from memory if it detects it.
Following up on "Kill CIH", I've got a stripped down version of Norton Anti-Virus that works from the
command line to scan the PC and repair files that are infected with CIH.
When the scan is complete, we can see
that it fixed almost everything other than 5 files.
A follow-up scan allows us to view the files that were not disinfected a bit more easily.
One of those is the Windows shell, explorer.exe, so it's a bit important that we take care of that.
Of all of these files I'm not particularly attached to the ClamWin tray icon
so I'll just delete that file to remove the infection.
4 more to go.
I've booted into MS-DOS using a Windows 98 boot diskette,
and I've also copied clean copies of the 4 programs from an uninfected machine.
It's a simple matter of replacing the infected copies with an uninfected one,
booting back into Windows,
and hoping our virus problem is eliminated.
When Norton repaired our infected files,
it copied the original infected version to an identically named file,
but with a .vir extension,
just in case something messed up and our repaired file was corrupted.
These are easily deleted by searching by searching for all files with a .vir extension,
and sending them to the Recycle Bin.
One quick scan later and we can see that our system is clean!
Norton found 1 infected file in the Recycle Bin, ClamWin's tray icon, and repaired it.
And now the system is completely free of CIH.
We are free to kill our time playing solitaire, rather than kill all of our time
and money repairing obnoxious virus infections.
Thank you for watching if you made it all the way to the end.
I had a lot of fun working on this video and I hope you enjoyed it too.
Take care.