CIH Virus
CIH virus infects Windows
95 and 98 EXE files. After an infected EXE is executed, the virus will stay in
memory and will infect other programs as they are accessed. CIH has been spreading
very quickly as it has been distributed through pirated software.
CIH, if activated,
can destroy hard disk data as well as corrupt some system booting information
of the infected PC. The virus will be activated on the following dates (depends
on variant):
- CIH v1.2- April
26th
- CIH v1.3- June
26th
- CIH v1.4- 26th
of every month
As a result, user may
find hard disk data lost and/or PC unable to boot. For
further information on the CIH virus, please check anti-virus
vendors such as DataFellows or Symantec.
Disk Boot Failure
If CIH was activated
on your Windows 95/98 system, you may find the system fail to start and it will
prompt "boot error", "insert bootable media" or "insert system disk". Although
there are reports that the content of the corrupted disk might be able to recovered
by disk utilities such as the Norton Disk Doctor, the chance of getting the data
back is little as the CIH already overwritten the first 1MB of the hard-disk with
random data (which contains the most important information of the file system).
If the data was very important, you can contact a professional data recovery company.
To recover your machine
for normal operation, it is recommended to:
- Partition/ format
the hard disk.
- Install the required
Operating System e.g. Windows 98.
- Restore programs/
data files from backup media.
No Video After Power Up
In case CIH was activated
on your Windows 95/98 system and there is no video after you turn on the machine,
the BIOS chip has been overwritteen and needs to be reprogrammed or replaced before
you can restore your system with the above steps.
Students
may refer to their PC's technical manual on how to re-flash the BIOS (if there
is any, and may require certain expertise!) or seek help from your PC supplier
while staff users can arrange with the following computer
vendors directly to replace the motherboard:
Protection from Viruses Attack
To protect from this and other viruses
attack, users are advised to:
- Update/install anti-virus utility
to the latest version periodically. For information on how to install F-Secure
Anti-Virus utility, please click here.
- Avoid running programs obtained
from un-secured source, such as download from Internet or mail attachments
received from friends.
- Backup data files periodically.
In case F-Secure Anti-Virus utility
reports any CIH infection, please click here on
how to disinfect the virus.