Summary

F-Secure Anti-Virus might detect files that were inaccurately disinfected from CIH virus as 'CIH.dam'. This happens when disinfected files still have parts of CIH virus code in their headers and/or in-between file sections.

Though the infection will not spread from such files, it is recommended to delete them and to restore these files from a backup.

[F-Secure AV Research Team; May 14th 2002]