Historical Documents Authorized Users of "CERT" Vulnerability Notes Database Vulnerability Disclosure Policy Courses

CERT^® Incident Note IN-99-03

The CERT Coordination Center publishes incident notes to provide information about incidents to the Internet community.

CIH/Chernobyl Virus

Thursday, April 22, 1999

Friday, April 23, 1999 -- Updated vendor information

Monday, April 26, 1999 -- Updated vendor information, added FAQ

Overview

We have received a number of information requests about a computer virus named CIH. Anti-virus vendors have given this virus the following names: CIH, Win95.CIH, PE_CIH, Win32.CIH, and W95/CIH.1003. The virus has also been called the Chernobyl virus. Some versions of the CIH virus become active on April 26, 1999 which is the 13th anniversary of the Chernobyl disaster.

In addition to this Incident Note please see the CIH FAQ (Frequently Asked Questions) document.

http://www.cert.com/tech_tips/CIH_FAQ.html

Description

The CIH virus infects executable files and is spread by executing an infected file. Since many files are executed during normal use of a computer, the CIH virus can infect many files quickly.

There are several variants of the CIH virus. Some activate every month on the 26th, while other variants activate just on April 26th or June 26th. Once the CIH virus activates, the virus attempts to erase the entire hard drive and to overwrite the system BIOS. Some machines may require a new BIOS chip to recover if overwritten by the CIH virus. CIH only affects Win95/98 machines.

More technical details about the CIH virus can be found at the following site.

http://www.virusbtn.com/VirusInformation/cih.html

Solutions

The following items will help to prevent the CIH virus from deleting your data or writing to the BIOS, but if your computer has already been damaged by the CIH virus the following will not help to recover. If your computer has been damaged by the CIH virus we recommend you contact your computer vendor or motherboard vendor to find out how to recover the system BIOS. The data on the hard drive might not be recoverable, but a data recovery service might be able to retore some portion of the data.

Many motherboards have a "jumper" that will enable or disable the ability to write to the BIOS. To prevent the CIH virus or any other program from writing to your computer BIOS, we recommend that you set the motherboard jumpers so that the BIOS can not be modified. Some motherboards vendors may ship with the jumper set in the writable/programmable mode for the BIOS.

This is a known virus and anti-virus vendors are able to detect the CIH virus. To detect and remove current viruses, you must update your scanning tools and anti-virus software with the latest virus signatures or definitions. To properly clean the CIH virus we recommend booting an infected computer from a clean floppy diskette (one that is not infected) and then run anti-virus software.

Vendor Information

Below is a list of anti-virus vendors that have futher infomation and tools relating to the CIH virus.

Computer Associates InoculateIT

http://www.cai.com/virusinfo/melissa_virus.htm#cih

Current Virus Signature Versions that Detect and Cure the CIH virus are as follows:

Any version of InoculateIT signature file later than 4.15 will detect and cure CIH.

Current version of InoculateIT signature file is 4.20.

Any of the above virus signatures files can be downloaded at www.support.cai.com

Data Fellows F-Secure Anti-Virus

http://www.datafellows.com/cih/

Network Associates/McAfee

http://www.avertlabs.com/public/datafiles/valerts/vinfo/spacefiller411.asp

ProLand Software

http://www.pspl.com/faqs/cihfaq.htm

http://www.pspl.com/download/cleancih.htm

Sophos

http://www.sophos.de/companyinfo/pressrel/uk/19990310chernobyl.html

Symantec/Norton AntiVirus

http://www.symantec.com/avcenter/venc/data/cih.html

http://www.symantec.com/avcenter/kill_cih.html

TrendMicro

http://216.33.21.51/vinfo/virusencyclo/default3.asp?VCode=EN001344

This document is available from: http://www.cert.org/incident_notes/IN-99-03.html

CERT/CC Contact Information

Email: cert@cert.org
Phone: +1 412-268-7090 (24-hour hotline)
Fax: +1 412-268-6989
Postal address:

CERT Coordination Center
Software Engineering Institute
Carnegie Mellon University
Pittsburgh PA 15213-3890
U.S.A.

CERT/CC personnel answer the hotline 08:00-17:00 EST(GMT-5) / EDT(GMT-4) Monday through Friday; they are on call for emergencies during other hours, on U.S. holidays, and on weekends.

Using encryption

We strongly urge you to encrypt sensitive information sent by email. Our public PGP key is available from

http://www.cert.org/CERT_PGP.key

If you prefer to use DES, please call the CERT hotline for more information.

Getting security information

CERT publications and other security information are available from our web site

http://www.cert.org/

* "CERT" and "CERT Coordination Center" are registered in the U.S. Patent and Trademark Office.

NO WARRANTY
Any material furnished by Carnegie Mellon University and the Software Engineering Institute is furnished on an "as is" basis. Carnegie Mellon University makes no warranties of any kind, either expressed or implied as to any matter including, but not limited to, warranty of fitness for a particular purpose or merchantability, exclusivity or results obtained from use of the material. Carnegie Mellon University does not make any warranty of any kind with respect to freedom from patent, trademark, or copyright infringement.

Conditions for use, disclaimers, and sponsorship information

CERT® Incident Note IN-99-03