Virus Profile: W95/CIH.1003

Threat Search
Print
   
Virus Profile information details
Risk Assessment: Home Low | Corporate Low
Date Discovered: 7/1/1998
Date Added: 9/7/1999
Origin: Taiwan
Length: 0
Type: Virus
Subtype: Win9x
DAT Required: 4002
Removal Instructions
   
 
 
   

Description

This is a virus detection. Viruses are programs that self-replicate recursively, meaning that infected systems spread the virus to other systems, which then propagate the virus further. While many viruses contain a destructive payload, it's quite common for viruses to do nothing more than spread from one system to another.

Indication of Infection

Increase in size of infected files.

The date of activation for the damaging payload depends on the variant of the virus.

Variant - Date of Payload
.1003 - on April 26th
.1010 - on June 26th
.1019 - on 26th of any month

When the date condition is met, this virus will attempt to overwrite sectors on the hard drive and also attempt overwrite BIOS on flash-capable systems.

Methods of Infection

The only way to infect a computer with a file infecting virus is to execute an infected file on the computer. The infected file may come from a multitude of sources including: floppy diskettes, downloads through an online service, network, etc. Once the infected file is executed, the virus may activate.

Aliases

Chernobyl, CIH v1.2, W32/CIH.Spacefiller, W95/CIH.1003a, W95/CIH.1003b, W95/CIH.1003c, W95/CIH.1003d, W95/CIH.1003dr, W95/CIH.1003e, W95/CIH.1003f, W95/CIH.1049, Win95.CIH, Win95/CIH.1003
   

Virus Characteristics

-- Update May 29, 2003 --
The 4267 DAT files contain enhanced detection of non-infectious W95/CIH.remnants. This detection/repair was included due to other vendors detecting these benign remnants.

This family of viruses, written in South-East Asia, first appeared in June 1998. Currently there are at least 35 variants available. However original variants (1003 and 1019) are by far most common and are `in the wild'. The viruses infect Windows 95 files in PE format. This virus contains a date activated payload. One alias to this virus is Chernobyl, which is a direct reference to the nuclear plant accident of the same name which occurred also on April 26th (in 1986).

W95/CIH viruses are able to split up the body of the virus code and place it within unused parts of the infected file (PE files usually contain lots of unused space). Such files will not execute on NT, Windows 2000 or XP because their structure is not valid (loader for Windows 95/98/Me is much less careless and can load such files).

The viruses contain a very dangerous payload, who's trigger date depends on the variant. On this date, they attempt to overwrite the flash-BIOS. If the flash-BIOS is write-enabled (and this is the case in most modern computers with a flash-BIOS) this renders the machine unusable because it will no longer boot. At the same time, they also overwrite the hard disk with garbage.

The viruses contain the following (unencrypted) strings:

CIH v1.2 TTIT

Variants

Variants information
Virus Name Type Subtype Differences
W95/CIH.1019 Virus Win9x Payload on 26th of any month.
W95/CIH.1010 Virus Win9x Minor differences only.
W95/CIH.1122 Virus Win9x
W95/CIH.remnants Virus Win9x This detection covers files where the file has been repaired so that the virus no longer runs, but the CIH code is still present in the file's cavities.
   
Use specified engine and DAT files for detection. To remove, boot to MS-DOS mode or use a boot diskette and use the command line scanner such as: SCAN C: /CLEAN /ALL