IT SECURITY ALERT: April 26th Windows 95/CIH Virus

[Elian Degen]

Avery and List.

Avery, thank you very much.

As I usually do, I checked with several sites before answering, THIS IS NOT
A HOAX, EXTREMELY DANGEROUS. I copied some info, and at the end I pasted
Symantec site, where you can get the antivirus, this site also includes
several antivirus for the most dangerous latest viruses as Melissa.

http://www.symantec.com/avcenter/


The CIH Virus Attacks
Dateline: 9/4/98

The CIH virus is one of the most malicious and ground breaking viruses to be
developed in the underground world. First identified in Taiwan back in June,
the CIH virus has spread throughout the world on Windows 95 and 98 PCs,
infecting applications when executed. On the 26th of each month infected PCs
may have their hard drives and flash BIOS chips overwritten!

CIH is a fast spreader because it started in Asia, where illegal copies of
software run rampant in some Asian countries. Both legal and illegal copies
of software have been infected by the CIH virus, including the ever-popular
"Wing Commander," by Origin Systems. The virus uses several advanced stealth
techniques to help hide it's presence on an infected PC.

If the hard drive of an infected PC is overwritten, backups of data can
easily be restored to a reformatted drive. Resetting the Flash BIOS is
another story...

Flash BIOS is normally protected by a jumper on the motherboard. But, some
machines have the jumper set to the "on" position for Flash BIOS
modifications. If the CIH virus overwrites the Flash BIOS the machine will
not boot until the chip is reprogrammed. That translates to major down time
for most users.

How CIH works

Once you've run an infected program, it goes resident in memory-- it just
sits there and waits.


Now, whenever you open another executable file, the infected program checks
to see if it's a "portable executable" file (that's the format used for
executable files in Windows 95 and 98).


The virus then checks whether the file can be infected. It can only be
infected if there's enough room for the virus.


If there is enough room, it infects the file. If the virus can't infect the
file-- or if the file has already been infected-- it checks the next
condition.



The next condition

Is it the 26th of the month?


If the answer is yes, the virus tries to overwrite your BIOS. Then it
trashes your hard drive.

GO TO THIS ADDRESS, AND YOU WILL FIND ALL YOU NEED TO TEST YOUR COMPUTER:

http://www.symantec.com/avcenter/