Overview
This is a virus detection. Viruses are programs that self-replicate recursively, meaning that infected systems spread the virus to other systems, which then propagate the virus further. While many viruses contain a destructive payload, it's quite common for viruses to do nothing more than spread from one system to another.
|
Minimum DAT
4002 (1998-12-02) Updated DAT4002 (1998-12-02) |
Minimum Engine
5.1.00 File Length0 |
Description Added
1999-09-07 Description Modified2003-05-29 |
Malware Proliferation
Characteristics
The 4267 DAT files contain enhanced detection of non-infectious W95/CIH.remnants. This detection/repair was included due to other vendors detecting these benign remnants.
This family of viruses, written in South-East Asia, first appeared in June 1998. Currently there are at least 35 variants available. However original variants (1003 and 1019) are by far most common and are `in the wild'. The viruses infect Windows 95 files in PE format. This virus contains a date activated payload. One alias to this virus is Chernobyl, which is a direct reference to the nuclear plant accident of the same name which occurred also on April 26th (in 1986).
W95/CIH viruses are able to split up the body of the virus code and place it within unused parts of the infected file (PE files usually contain lots of unused space). Such files will not execute on NT, Windows 2000 or XP because their structure is not valid (loader for Windows 95/98/Me is much less careless and can load such files).
The viruses contain a very dangerous payload, who's trigger date depends on the variant. On this date, they attempt to overwrite the flash-BIOS. If the flash-BIOS is write-enabled (and this is the case in most modern computers with a flash-BIOS) this renders the machine unusable because it will no longer boot. At the same time, they also overwrite the hard disk with garbage.
The viruses contain the following (unencrypted) strings:
CIH v1.2 TTIT
Symptoms
The date of activation for the damaging payload depends on the variant of the virus.
Variant - Date of Payload
.1003 - on April 26th
.1010 - on June 26th
.1019 - on 26th of any month
When the date condition is met, this virus will attempt to overwrite sectors on the hard drive and also attempt overwrite BIOS on flash-capable systems.
Method of Infection
The only way to infect a computer with a file infecting virus is to execute an infected file on the computer. The infected file may come from a multitude of sources including: floppy diskettes, downloads through an online service, network, etc. Once the infected file is executed, the virus may activate.
Removal
Use specified engine and DAT files for detection. To remove, boot to MS-DOS mode or use a boot diskette and use the command line scanner such as:
Variants
W95/CIH.remnants
W95/CIH.1010
W95/CIH.1019
W95/CIH.1122