Information about CIH virus
CIH Variants

INFORMATION ABOUT CIH VIRUS

The CIH, which was first located in Taiwan, is a virus that infects Windows 95 and Windows 98 EXE files. After an infected EXE is executed, the virus will stay in memory and will infect other programs as they are accessed and overwrites most of the data on the computer's hard disk drive. This virus also includes another unique feature that will attempt to overwrite the Flash BIOS chip of the machine. If the Virus is successful at doing this, the machine will be unable to boot at all unless the chip is reprogrammed. Another feature that this virus includes is the capability of not increasing the size of the EXE file that it infects, therefore would not be noticed by any user unless an virus scanner detects it.

Later on, CIH was available by accident from several commercial web sites, including the Origin Systems website, where a download related to the popular Wing Commander game was infected. This issue has been contained.

CIH VARIANTS

CIH v1.2 TTIT (CIH 1003) which activates on April 26th of any year, and is the most common CIH variant.
CIH v1.3 TTIT (CIH 1010) which activates on Jun 26th of any year.
CIH v1.3 TTIT (CIH 1010.B) which activates on Jun 26th of any year.
CIH v1.4 TATUNG (CIH 1019) which activates on the 26th of every month.