CIH virus information

Information about CIH virus

The CIH (Chernobyl) is a virus first detected in Taiwan in 1999 that infects Windows 95 and Windows 98 exe files. After an infected exe is executed, the virus stays in memory and infects other programs as they're accessed and overwrites most of the data on the computer's hard drive.

This virus also attempts to overwrite the BIOS (basic input/output system) of the machine. If the virus is successful at doing this, the machine cannot boot at all unless the chip is reprogrammed. Another feature of this virus is the capability of not increasing the size of the exe file that it infected to help prevent detection.

Later, CIH was available by accident from several commercial websites, including the Origin Games website, which temporarily provided an infected download related to the game Wing Commander. (The virus was removed when discovered.)

CIH variants

CIH v1.2 TTIT (CIH 1003) which activates on April 26th of any year, and is the most common CIH variant.
CIH v1.3 TTIT (CIH 1010) which activates on Jun 26th of any year.
CIH v1.3 TTIT (CIH 1010.B) which activates on Jun 26th of any year.
CIH v1.4 TATUNG (CIH 1019) which activates on the 26th of every month.