The CERT Coordination Center publishes incident notes to provide
information about incidents to the Internet community.

<h2>CIH/Chernobyl Virus</h2>
<dd>Thursday, April 22, 1999
<dd>Friday, April 23, 1999 -- Updated vendor information
<dd>Monday, April 26, 1999 -- Updated vendor information, added FAQ
<p>We have received a number of information requests about a computer
virus named CIH.  Anti-virus vendors have given this virus the
following names: CIH, Win95.CIH, PE_CIH, Win32.CIH, and W95/CIH.1003.
The virus has also been called the Chernobyl virus. Some versions of
the CIH virus become active on April 26, 1999 which is the 13th
anniversary of the Chernobyl disaster.

<p>In addition to this Incident Note please see the CIH FAQ (Frequently Asked Questions) document.

<p><dt><dd><a href="/tech_tips/CIH_FAQ.html"></a></dd></dt>
<p>The CIH virus infects executable files and is spread by executing
an infected file.  Since many files are executed during normal use of
a computer, the CIH virus can infect many files quickly.

<p>There are several variants of the CIH virus.  Some activate every
month on the 26th, while other variants activate just on April 26th or
June 26th.  Once the CIH virus activates, the virus attempts to erase
the entire hard drive and to overwrite the system BIOS.  Some machines
may require a new BIOS chip to recover if overwritten by the CIH
virus.  CIH only affects Win95/98 machines.

<p>More technical details about the CIH virus can be found at the
following site.

<p><dt><dd><a href=""></a></dd></dt>
<p>The following items will help to prevent the CIH virus from
deleting your data or writing to the BIOS, but if your computer has
already been damaged by the CIH virus the following will not help to
recover.  If your computer has been damaged by the CIH virus we
recommend you contact your computer vendor or motherboard vendor to
find out how to recover the system BIOS.  The data on the hard drive
might not be recoverable, but a data recovery service might be able to
retore some portion of the data.

<p>Many motherboards have a "jumper" that will enable or disable the
ability to write to the BIOS.  To prevent the CIH virus or any other
program from writing to your computer BIOS, we recommend that you set
the motherboard jumpers so that the BIOS can not be modified.  Some
motherboards vendors may ship with the jumper set in the
writable/programmable mode for the BIOS.

<p>This is a known virus and anti-virus vendors are able to detect the
CIH virus.  To detect and remove current viruses, you must update your
scanning tools and anti-virus software with the latest virus
signatures or definitions.  To properly clean the CIH virus we
recommend booting an infected computer from a clean floppy diskette
(one that is not infected) and then run anti-virus software.

<h3>Vendor Information</h3>

Below is a list of anti-virus vendors that have futher infomation and
tools relating to the CIH virus.

<p><b><u>Computer Associates InoculateIT</u></b>
<dt><dd><a href=""></a>
<p>Current Virus Signature Versions that Detect and Cure the CIH virus
are as follows:

  <dd><li>Any version of InoculateIT signature file later than 4.15 will
  detect and cure CIH.

  <dd><li>Current version of InoculateIT signature file is 4.20.

<p>Any of the above virus signatures files can be downloaded at
<a href=""></a>
<p><b><u>Data Fellows F-Secure Anti-Virus</u></b>
<dt><dd><a href=""></a></dd></dt>
<p><b><u>Network Associates/McAfee</u></b>
<dt><dd><a href=""></a></dd></dt>
<p><b><u>ProLand Software</u></b>
<dt><dd><a href=""></a></dd></dt>
<dt><dd><a href=""></a></dd></dt>
<dt><dd><a href=""></a></dd></dt>
<p><b><u>Symantec/Norton AntiVirus</u></b>
<dt><dd><a href=""></a></dd></dt>
<dt><dd><a href=""></a></dd></dt>
<dt><dd><a href=""></a></dd></dt>
<p><!--#include virtual="/include/footer_nocopyright.html" --> </p>
<p>Copyright 1999 Carnegie Mellon University.</p>