cleancih.exe

This is a small program written to help you dealing with dangerous CIH virus.

Instructions: Restart your computer in MS-DOS mode. Then run this program from the command line typing cleancih c:\ /prompt. This will check your C: drive for the virus, and if found, ask you to confirm the desinfection. Do the same if D: or other hard drive exists on your configuration.

It might happen that some files are damaged after desinfection, and cannot run. In that case, be ready to write down paths and names of the files that were not successfully desinfected, and replace them with undamaged files ASAP.

Oh, I almost forgot... Download this file here.


ska [Happy99.exe]

Follow this steps to get rid of this Internet worm.
  1. Delete files ska.exe and ska.dll from \windows\system folder.
  2. Delete the following Registry key:
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Ska.exe="Ska.exe"
    Start regedit.exe via Start/Run, choose Find and copy complete path. If Regedit doesn't find anything, go folder by folder to \RunOnce\ part. If there is no Ska.exe written there, it means that virus is not activated yet
  3. Restart computer in MS-DOS mode.
  4. Using cd command go to \windows\system folder
  5. Recover old Winsock file using the following DOS commands:

    ren wsock32.dll wsock32.bad
ren wsock32.ska wsock32.dll
  6. Restart Windows [DOS command: win].