14 Win.CIH viruses none detected but 1

[goa103]

Hello,

I tried AVAST with one of my favourite infected CD-ROM, it contains 14 Win.CIH infected files. It was only able to detect 1 infected file. Norton 2002 detected the 14. I then copied the file to my HD and try to repair 1. I don't think It repaired it because Norton still detected 14 infected files.

ps: sorry but I also emailed the supported, didn't notice there was a forum

[kubecj]

Send the files to support@asw.cz. They don't have to be real viruses, no matter what another antivirus have said.

Re: the virus removal - avast doesn't  remove file viruses by design.

[raman]

Hi,

for my information, what does Norton Say? Win.cih , Win.cih.corrupted or wincih.damage? It could be some misscleand Viruses, which are not able to replecate anymore.

[Pavel Baudis]

It could be some misscleand Viruses, which are not able to replecate anymore.

Yes, this could be really anything. Can you please send the files to support@asw.cz as suggested by kubecj?

Thanks for your cooperation!

Pavel

[Pavel Baudis]

We still did not get the files from the original poster  

We have received 4 similar files through other channel and none of them was infected by CIH. I still believe that goa103 can send us the suspected files!

Pavel

[goa103]

Hello,

Sorry for the late reply, I have just sent an email to the support with a screenshot from Norton AntiVirus and the supposed-infected file. I hope it's just a warning.

Thanks again and sorry for the late reply.

[raman]

@Pavel,
FMI:  Are the files infected, goa103 send?

[kareld]

Dear Jean-Marc,
    the attachment with suspected files missed in your mail. I tried to reply to you directly, but  I got the error:

   ----- Transcript of session follows -----
mail.local: unknown name: goa
550 ***mail address***... User unknown

Pleas send the files directly to me, divis@asw.cz.

[goa103]

@Pavel,
FMI:  Are the files infected, goa103 send?

Hi Raman,

I uninstalled Avast! Pro a few weeks again and decided to try the Home version at home (logical ^^). When I tried to send them the files again, Avast! successfully detected the "Win95:CIH 1.x" infected files. So I had to disable Avast! in order to send the files. I think they probably updated their virus database but we will probably know more about it in a few days.

I have a few AntiVirus to try but I like the Avast! philosophy, free forum to post comments, free feedback, quick answers... I can't believe you have to pay 30$ to ask a question to Symantec (Norton AntiVirus), It's a real ripoff. Moreover I had some troubles with Norton 2002. It kind of corrupted all my backup files, I am still investigating and I asked some advices to Avast! experts. They probably know a few things about that ISSUE. A BIG one in my opinion!

Last but not least, the more we will report viruses to them, the more we will give them feedback, the more they will be able to improve Avast! Anyway using an AntiVirus software doesn't mean you have to get all the junk files of the Internet. From now on It's what I am trying to do, not to get files from unknown locations or users. Safely download your files from CNET Download.com, don't use P2P networks to get Archive files or Executable files...

Okay I am very talkative today but Viruses have been a big issue for me in the last 2 months, I thought I was infected but Norton was in charge and It simply corrupted my HD... God damned!

[kareld]

Dear Jean-Marc,
   I prefixed the mail subject with [NOTASPAM], nevertheless the mail was bounced. So I post my answer to the forum.
   From your attached files, "Froggie over the fence.zip", "8 bit view - PCX TGA BMP GIF.zip" and "24 bit view - PCX TGA BMP GIF.zip" are clean - there is no binary file with CIH in them. The file "Cube multimapping.zip" seems to be corrupted, I wasn't able to unpack it. There are 2 infected files in "map flat shed - spherical.zip" and 5 "Atelier Visual C++.zip". The files in the archive "Atelier Visual C++.zip" are not infected completly - the files contain viral code, but the entry point isn't moved to it, so viral code isn't launched.
   I don't know about the problem with Norton Antivirus.  I'd guess you are using old Norton with new Windows XP - there was a major change in Windows XP in june of 2002, between beta and release version, but it's just a guess.