Hardware Secrets
Home | Camera | Case | CE | Cooling | CPU | Input | Memory | Mobile | Motherboard | Networking | Power | Storage | Video | Other
Content
Articles
Editorial
First Look
Gabriel’s Blog
News
Reviews
Tutorials
Main Menu
About Us
Awarded Products
Compare Prices
Datasheets
Dictionary
Download
Drivers
Facebook
Forums
Links
Manufacturer Finder
Newsletter
On The Web
RSS Feed
Test Your Skills
Twitter
Newsletter
Subscribe today!
Search



Recommended
PC Disaster and Recovery
PC Disaster and Recovery, by Kate J. Chase (Sybex), starting at $1.85
Home » Storage
Recovering Hard Disks Erased by the CIH Virus
Author: Gabriel Torres
Type: Tutorials Last Updated: October 16, 2004
Page: 1 of 1
Real-time pricing for Synology DX510.
Synologynode Synology 5-Bay Plug-n-Use Expansion Unit to DS1010 DS710 and DS1511 & DS712 Network Attached Storage DX510 Black AZDH-DX510 Electronics
Amazon: $499.99 TigerDirect: $555.99
CompUSA: $555.99 Buy.com: $499.98

The CIH (a.k.a. Chernobyl or Spacefiller) is one of the most fierces virus available. On its activation date (April 26th) it tries to erase your computer's BIOS and also your hard disk.

To recover your hard disk, you will need to use a data recovery software. From all softwares we tested, the best one is the Fix-cih, which is free and can be downloaded at http://www.grc.com/files/fix-cih.exe. This software is small and really efficient. You will need to create a bootable floppy and copy this program to it, and then boot the infected computer from this floppy. Format this floppy from a computer without virus (of course) and using at least Windows 98 (if you format it using DOS or Windows 95, it won't recognize FAT32 partitions and you probably won't be able to recover your hard disk). Run the software and wait. It can take a couple of hours recovering your data, specially with you have a large hard disk.

After recovering the hard disk, you will need to run an antivirus software to remove the virus, that will still be stored on your hard disk. We recommend you to download and run cleancih, which can be downloaded from http://www.pspl.com/download/cleancih.exe. This is a 20 KB DOS software, so you can copy it to your bootable floppy and run it after booting from a floppy. Don't try to boot your from your hard disk, because it is infected and you won't be able to remove the virus.

To boot your PC from a floppy disk, you need to enter setup (pressing Del key during the memory count that occurs when you turn your PC on) and change the Boot Order (or Boot Sequence) option to "Floppy", "A:, C:" or similar.

Notice that probably your motherboard will be "dead", since the CIH virus tries to erase its BIOS. If that is your case, read our tutorial on how to recover motherboards "killed" by the CIH virus.

 
Print Version | Send to Friend | Bookmark Article | Comments (0)

Related Content
  • Testing Your Computer Security
  • Recovering Dead Motherboards Killed by the CIH Virus
  • BIOS Backup
  • How to Enable Processor-Based Security
  • Transforming your Radeon 9800 Pro into a Radeon 9800 XT

  • Recommended Deal.
    Oo ST31500341ASOo ST31500341AS

    OO O&O PartitionManager 2 Professional Edition Software Used and New Usually ships in 24 hours

    Amazon: $49.95

    RSSLatest News
    Nexus Introduces the Thrio 310 PC Case
    May 22, 2012 - 8:50 AM PST
    Corsair Upgrades GS Series Power Supplies
    May 17, 2012 - 12:49 PM PST
    New 140 mm Case Fans from Arctic
    May 17, 2012 - 12:47 PM PST
    Intel Intros New Intel Xeon Processors
    May 15, 2012 - 5:04 PM PST
    Transcend Launches mSATA SSD Drives
    May 11, 2012 - 8:56 AM PST
    NVIDIA Launches GeForce GTX 670
    May 10, 2012 - 7:44 AM PST
    .:: More News ::.




    © 2004-12, Hardware Secrets, LLC. All rights reserved.
    Advertising | Legal Information | Privacy Policy
    All times are Pacific Standard Time (PST, GMT -08:00)