W95/CIH-10xx

Category: Viruses and Spyware Protection available since:09 Apr 2003 00:00:00 (GMT)
Type: Windows 95 executable file virus Last Updated:22 Sep 2003 00:00:00 (GMT)
Prevalence: Several Reports

Download Download our free Virus Removal Tool - Find and remove threats your antivirus missed

CIH is a family of computer viruses which infect Windows 95/98 programs. If you run an infected program on your computer, the virus will become active and begin to copy itself into other programs (EXE files) on your system. The virus usually replicates very quickly, so you will probably soon have hundreds of infected files on your computer.

Normally, CIH simply spreads itself. But on certain trigger dates (the most common variants of the virus activate on 26 April, but other variants activate on 26 June or even on the 26th of any month), it detonates its warhead. CIH is a family of computer viruses which infect Windows 95/98 programs. If you run an infected program on your computer, the virus will become active and begin to copy itself into other programs (EXE files) on your system. The virus usually replicates very quickly, so you will probably soon have hundreds of infected files on your computer.

Normally, CIH simply spreads itself. But on certain trigger dates (the most common variants of the virus activate on 26 April, but other variants activate on 26 June or even on the 26th of any month), it detonates its warhead.

The warhead wipes data from your hard disk, and then tries to overwrite the computer's BIOS chip. Once the BIOS is overwritten, you will be unable to use your computer at all. Repair involves physically removing the BIOS chip and replacing it with a fresh one. On some computers, the BIOS chip is not removable, so it can only be replaced by swapping the entire motherboard.

The virus was first reported in June 1998, and has been widely reported in-the-wild.

download Try Sophos products for free
Download now