[ISN] Chernobyl virus set to wake up

From: InfoSec News (isnat_private)
Date: Wed Apr 25 2001 - 13:12:43 PDT

  • Next message: security curmudgeon: "Re: [ISN] Internet Security Systems Moves to Parry Drive-by Hackers"

    http://news.cnet.com/news/0-1003-200-5724969.html?tag=lh
    
    By CNET News.com Staff
    April 25, 2001, 11:05 a.m. PT
    
    A 3-year-old virus may damage some PCs Thursday when it's set to
    strike again.
    
    Known as CIH, or the more dire-sounding Chernobyl, the virus first hit
    a month after the Melissa virus three years ago and is due to strike
    on Thursday.
    
    Antivirus software company Trend Micro warned that though the outbreak
    may not be severe or widespread, CIH can nevertheless wreak havoc on a
    computer's hard disk by deleting the information the disk needs to
    find files.
    
    CIH is an old file infector that originated in Taiwan and was
    discovered in June 1998. The writer, Chen Ing-Hau, created the virus
    while he attended university in the island nation.
    
    It struck an estimated as 700,000 to 1 million PCs worldwide on April
    26, 1999, with high incidences of infection in Asia, the Middle East
    and Eastern Europe. Very few of those incidents have been verified,
    however.
    
    Although the number of CIH cases fell sharply in April last year, it
    still caused considerable damage.
    
    It infects only Windows 95 and Windows 98 systems and activates when
    the system month reads April and the system day reaches 26. When one
    antivirus company noticed that the date coincided with the anniversary
    of the Chernobyl nuclear plant accident, it dubbed the virus
    "Chernobyl."
    
    When CIH triggers, it tries to overwrite critical information on the
    system's hard disk and, on some computers, deletes system information
    storied in BIOS memory, which leaves the computer unbootable.
    
    Some variants of this virus are triggered on the 26th day of other
    months.
    
    ISN is hosted by SecurityFocus.com
    ---
    To unsubscribe email LISTSERVat_private with a message body of
    "SIGNOFF ISN".
    



    This archive was generated by hypermail 2b30 : Thu Apr 26 2001 - 02:18:37 PDT