W95.CIH.Remanats

Discussion in 'NOD32 version 1 Forum' started by zappa, Apr 20, 2003.

Thread Status:
Not open for further replies.
  1. zappa

    zappa Registered Member

    Joined:
    Feb 9, 2002
    Posts:
    176
    Location:
    Los Angeles, Ca.
    Somehow this bugger showed up on my system. I get the notice that it can't be deleted and no other options given.
    Nod has changed the original name and it is my windows/temp folder as a temp file.(I am using Win98SE.)

    I went to safemode and was not allowed to delete it.

    There are 4 temp files in my windows/temp folder that I cannot delete. I used a hex editor to see what was in the files and they all say "root entry". The contents of one temp file included my system.ini with my windows password cpl file too.

    I looked up the virus at Nod and it says Nod cleans it. I ran another A.V. and it finds the same virus in "personal folder" of which I cannot find in and of itself. I tried deleteing it with the second AV but it won't delete. Nod says same personal folder is locked and can't scan or clean it.


    So, how do I delete the temp files and get rid of this sucker?
    Thank you.


    I forgot to mention I was poking around my RegRun program and I saw this same temp file was in my startup somehow. There wasn't an option to delete it in the RegRun screen i was looking at. I forget which option I clicked on to see it, RegRunGold has a billion options.

    (I get dizzy with all the questions RegRunG constantly asks me. I have a coin close by to flip as the registry changes it notifies me of are over my head and I have no idea whether the changes are good bad or even steven.)
     
  2. Finn McCool

    Finn McCool Registered Member

    Joined:
    Mar 3, 2003
    Posts:
    49
    Location:
    New Orleans
    I wouldn't lose any sleep over it. W95.CIH.Remnants is not a working virus, but the remnants of w95.CIH after the file was cleaned. It's not going to do anything.

    Have you checked the attributes of the file? You may have to change it from read only.
     
  3. zappa

    zappa Registered Member

    Joined:
    Feb 9, 2002
    Posts:
    176
    Location:
    Los Angeles, Ca.
    FMC-
    My fault for not making it clear on what I was looking for. I was/am looking for advice on how to delete the temp files which would then alleviate the second issue of it continuing to pop up upon scanning.
    Seems like a reasonable request to me.

    PS-Yes, I changed the attributes of the file to no avail.
     
  4. jan

    jan Former Eset Moderator

    Joined:
    Oct 25, 2002
    Posts:
    804
    Hi zappa,

    we need to check the files. I sent you a PM.

    Cheers, :)

    jan
     
Thread Status:
Not open for further replies.