advertising information
   personal technology

 custom news
 Headline News brief
 daily almanac
 CNN networks
 CNN programs
 on-air transcripts
 news quiz

CNN Websites
 video on demand
 video archive
 audio on demand
 news email services
 free email accounts
 desktop headlines

 message boards




PC World

How to prepare yourself for the CIH 1.2 virus

computer virus

March 12, 1999
Web posted at: 11:44 a.m. EST (1644 GMT)

by Stan Miastkowski

(IDG) -- The ICSA and the Antivirus Product Developers Consortium this week issued a bulletin about the CIH 1.2 virus, which is scheduled to trigger on April 26.

"People need to pay attention to this one," says Roger Thompson, director of antivirus and malicious code research for the ICSA, an independent organization that certifies antivirus software and that rarely issues such alerts.

New and nasty variant

CIH 1.2 is a file virus that infects Windows 95/98 EXE files, and infects your PC when the application is run.

It's a relatively new and nasty variant of the original CIH virus, which first appeared in May of 1998, and received widespread publicity at the time. The original CIH triggers on the 26th of every month, but never became widespread.

The latest variant, however, is considered to be common, and ranks 17 on Joe Wells' respected Wild List of viruses.

  PC World home page
  FileWorld find free software fast
  Make your PC work harder with these tips
 Reviews & in-depth info at's desktop PC page's portable PC page's Windows software page's personal news page
  Questions about computers? Let's editors help you
  Subscribe to's free daily newsletter for computer geniuses (& newbies)
  Search in 12 languages
 News Radio
  Fusion audio primers
  Computerworld Minute

CIH 1.2 is particularly nasty because it has what virus researchers call a dual payload. When it triggers, it first attempts to overwrite your PC's BIOS setup. This works only with a Flash BIOS that can be upgraded via software, and because there's no industry standard way of programming a Flash BIOS, CIH isn't always successful at doing its dirty work. But if it is successful, your PC won't start until the BIOS is reprogrammed.

Whether or not CIH 1.2 is successful at overwriting the BIOS, what it does next is even worse. It overwrites your entire hard disk with random data, erasing all your data and applications.

Getting prepared

The ICSA's Thompson has two suggestions for all PC users: Get your antivirus software up to date, and back up your data.

According to the ICSA, all recent versions of ICSA-certified antivirus software can detect and remove the CIH 1.2 virus. But it's still worthwhile to check the Web site of your antivirus software maker to make sure it detects CIH 1.2. Spot checks of antivirus software sites, including industry leaders Symantec and McAfee, show that current updates do.

And if your PC isn't equipped with antivirus software, what are you waiting for? Several companies, including McAfee, Symantec, and Trend Micro, offer free trial versions of their antivirus software.

Top 10 antivirus tools
February 9, 1999
Internet worm can crash corporate servers
January 29, 1999
Security elite form SWAT teams to attack viruses
January 19, 1999
Workplace computer virus infections on the rise
September 15, 1998

(PC World Online)
Virus killers '98
(PC World Online)
No matter the browser, protect yourself with this free Web virus scanner
(PC World Online)
Hotmail offers free virus detector
Virus killers offer strong protection
(PC World Online)
VPNs, integrated security on tap at RSA conference

Note: Pages will open in a new browser window
External sites are not endorsed by CNN Interactive.

McAfee Virus Clinic
Trend Micro, Inc.
Joe Wells WildList

Note: Pages will open in a new browser window
External sites are not endorsed by CNN Interactive.

Enter keyword(s)   go    help

Back to the top   © 2001 Cable News Network. All Rights Reserved.
Terms under which this service is provided to you.
Read our privacy guidelines.