11.973 bytes

Service Hints & Tips

Document ID: DETR-46NRJW

Aptiva - Information on Aptiva PCs and the CIH virus

Applicable to: United States

A very limited number of IBM Aptiva E Series models 240, 301, 520 and 580 might contain a version of a computer virus known as CIH. Our tests indicate that the CIH virus, if it is not removed, erases the contents of the infected computer's hard disks when the date on your computer reads April 26 of any year.

If you have recently purchased one of the models listed above, please read the following notice.

NOTICE: To determine whether your computer is infected, from the Microsoft Windows desktop, click Start, Programs, Norton AntiVirus, and Norton AntiVirus. This starts the Norton AntiVirus program.

• If you do not receive an error message, your computer does not have the CIH virus. However, we strongly recommend that you use the LiveUpdate feature of the Norton AntiVirus program to ensure that you have up-to-date antivirus definitions files. For your convenience, we have included instructions for using the LiveUpdate feature at the bottom of this document.

• If you receive the following message, your computer probably has the CIH virus:

"The file NAV32W.EXE has been altered. Please restart your computer using your NAV Rescue Disk and scan for viruses. If no virus is found, try reinstalling Norton AntiVirus from your original disks."

Attention: If your Aptiva PC is infected, be sure not to transfer any files that end in ".EXE" to another computer. Doing so might possibly spread the virus.

NOTE: If you have not determined whether your computer is infected by the night of April 25, unplug your system. You may safely plug the system back in on or after April 27 at which time you must take one of the following actions.

To correct the problem, take one of the following actions:

• Use Update Connector to download a solution which "cleans" the hard disk of the virus.

1. From the Windows Desktop, click on Start.
2. Select Update Connector.
3. Follow the on-screen directions to run Update Connector and download the update.

• Alternately, IBM will make this solution available to you on a CD which we will ship to you via express mail at your request. To request a copy of the CD, please call (800) 600-8235 and ask for the "IBM Aptiva Antivirus Update CD".

• A third way to remove the virus from your Aptiva is to reinstall the software that was originally delivered with your system using the Product Recovery and Diagnostics CD-ROM, as described below. If you have not stored irreplaceable data on your C: drive and you have not installed applications you cannot reinstall, this may be an acceptable and immediate approach. This approach will remove ALL the data and programs you have installed.

Attention: This process will COMPLETELY erase all of the files on your hard disk, including all of the files that you have created, downloaded, or installed on your computer. You might want to back up your data files, such as written documents, financial information, pictures, audio files, and spreadsheets, before you start this procedure.
Do not back up files that end in .EXE.

1. If the computer is turned off, turn it on.
2. Insert the red Product Recovery & Diagnostics CD-ROM into the CD/DVD drive, and close the drive door.
3. Turn off the computer.
4. Wait ten seconds. Turn on the computer. The IBM Product Recovery Program Main Menu appears automatically.
5. From the Recovery Options, select Full Recovery. It should already be highlighted in white.
6. Press Enter to continue.
7. Each time a pop-up menu appears, type Y when prompted, and press Enter until you see the computer copying multiple files. When all files have been copied (after approximately ten minutes), a message entitled "Recovery is Complete" is displayed.
8. When you are prompted to restart the computer, remove the Product Recovery & Diagnostics CD-ROM from the CD/DVD ROM, close the drive door, and press Ctrl+Alt+Delete.
9. Use the Norton AntiVirus LiveUpdate function.


Once you have followed one of the procedures listed above and have removed the virus from your system, we strongly recommend that you use the LiveUpdate feature of the Norton AntiVirus program to ensure that you have up-to-date antivirus definitions files. For your convenience, we have included instructions for using the LiveUpdate feature. After you have updated your Norton AntiVirus program, be sure to scan all backup diskettes that you might have made.

If you have any questions or require further assistance, please call (800) 600-8235 and we will be happy to assist you.

LiveUpdate Instructions:
Keeping your Norton AntiVirus signature files up-to-date is important to ensure that Norton AntiVirus is able to detect new viruses. Although IBM provided you with the latest version of Norton AntiVirus that was available when your Aptiva computer was designed, it is important to check for updates frequently. To keep Norton AntiVirus current, use the Norton AntiVirus LiveUpdate function to obtain the latest signature files. These files only take a few minutes to download. To obtain the latest signature files, perform these steps:

To connect directly to Norton:
1. Ensure that your computer modem is correctly connected to a phone line.
2. Click Start, Programs, Norton AntiVirus, and Norton AntiVirus to start the program.
3. Click on LiveUpdate.
4. Select Modem from the selection box, and click Next.
5. If you are prompted for your area code and dialing information, supply these and click OK.
6. The number that is being dialed is displayed. Click OK to proceed.
7. The appropriate updates will be downloaded and installed on your computer.

To connect through the Internet:
1. Ensure that your computer modem is correctly connected to a phone line and that you have your internet service properly set up.
2. Connect to your internet service provider.
3. Click Start, Programs, Norton AntiVirus, and Norton AntiVirus to start the program.
4. Click LiveUpdate.
5. Select Internet from the selection box, and click Next.
6. The appropriate updates will be downloaded and installed on your computer.

When all the latest signature files have been downloaded and installed on your computer, it is important to scan all diskettes and other removable media (except CDs or DVDs) to prevent the spread of the virus or possible reinfection. If you have used these diskettes with other computers it is important to notify the owners of those computers and instruct them to run their current antivirus program with the latest signature files.

If the other computers are not protected by an antivirus program, the owners of those computers should remove the CIH virus from memory via:
1. Download KILL_CIH from Symantec at:
http://www.symantec.com/avcenter/kill_cih.html

2. Immediately purchase and install an antivirus program for actual CIH virus removal from your disk drives and continued protection.
For a 30-day trial of Norton Antivirus, download the Norton Antivirus Trialware at:
http://shop.symantec.com/trialware/

Support for the Trialware is only provided online at: http://www.symantec.com/techsupp/

If you do not have access to the Internet, you may call Symantec at (800) 441-7234 to request a copy of Norton Antivirus Trialware.

	Search Keywords
	Hint Category	Error Messages, Utility Software
	Date Created	05-04-99
	Last Updated	23-04-99
	Revision Date	23-04-2000
	Brand	IBM Aptiva
	Product Family	Aptiva
	Machine Type	2158, 2163
	Model	240; 301; 580; 520
	TypeModel
	Retain Tip (if applicable)
	Reverse Doclinks and Admin Purposes