Type: Presence computer virus
Characteristic: This computer virus belong to the W32 family, infects Windows in 95/98 take EXE as the suffix feasible document. It has the enormous destructiveness, may rewrite BIOS to cause it useless (, so long as computer's microprocessor is Pentium Intel 430TX), its consequence is causes the user the computer to be unable to start, the only solution replaces system original chip (chip), this computer virus manifest suddenly on April 26, it will also destroy in the computer hard disk, therefore information. This computer virus will not affect MS/DOS, Windows 3.x and Windows the NT operating system.
Dissemination way: CIH may use all possible ways to carry on the dissemination: Floppy disk, CD-ROM, Internet, FTP downloading, email and so on. When carries out when the document which infects the computer virus will only then manifest suddenly, otherwise the computer virus will be forever at the latency. Symptom: The computer virus possibly hide in any take EXE as the extension may in the execution document, but, only will then carry out these documents, the computer virus will only then manifest suddenly. Once the computer virus are activated (have carried out belt poisonous document), the computer virus carry on the sabotage, some are obvious, but other possibly do not pay attention.
The following is the influence which the computer virus possibly produce:
1. it will be resident the memory, this means that the Windows 95/98 system call any (will open, closure, heavy naming, duplication or movement) as expands take EXE
When exhibition document can infect the computer virus.
2. covers and rewrites the BIOS information to cause it being unable to work.
3. destroys in hard disk's all information (formatted hard disk) to encounter the computer virus to destroy the computer which starts when has the following prompt: “DISK BOOT
FAILURE, INSERT SYSTEM DISK AND PRESS ENTER ". Moreover, if the user guides and attempts to visit the hard disk from the floppy disk, will present the following information " INVALID DRIVE SPECIFICATION ". This computer virus contain the following string of character in its code " CIH v1.2 TT IT ".
This computer virus' first variety is called CIH v1.3 or CIH.1010, this variety will manifest suddenly in June 26, below it will contain in its code
String of character: “CIH v1.3 TT IT”. The second variety is called CIH v1.4 or CIH.1019, it will manifest suddenly in each month's on 26th, has enormously
Destructiveness. It will delete in Flash-BIOS all information, will therefore cause the computer connection not to be able to find as a whole, because in BIOS had already not carried out this
Function procedure.
But, even if started the computer, the hard disk could also not find, because the hard disk information also lost the CHI.1019 destruction hard disk information the way is recomposition content. This variety contains the following string of character in its code: “CIH v1.4 TATUNG”.
Other pages: : 1 * 2 * Next>>
|
You are here: hacking technology
> the virus to be related
> Content
Category: Home
> the virus to be related