From...

March 12, 1999
Web posted at: 11:44 a.m. EST (1644 GMT)

by Stan Miastkowski

(IDG) -- The ICSA and the Antivirus Product Developers Consortium this week issued a bulletin about the CIH 1.2 virus, which is scheduled to trigger on April 26.

"People need to pay attention to this one," says Roger Thompson, director of antivirus and malicious code research for the ICSA, an independent organization that certifies antivirus software and that rarely issues such alerts.

New and nasty variant

CIH 1.2 is a file virus that infects Windows 95/98 EXE files, and infects your PC when the application is run.

It's a relatively new and nasty variant of the original CIH virus, which first appeared in May of 1998, and received widespread publicity at the time. The original CIH triggers on the 26th of every month, but never became widespread.

The latest variant, however, is considered to be common, and ranks 17 on Joe Wells' respected Wild List of viruses.

MORE COMPUTING INTELLIGENCE
	IDG.net home page
PC World home page
FileWorld find free software fast
Make your PC work harder with these tips
Reviews & in-depth info at IDG.net
		IDG.net's desktop PC page
		IDG.net's portable PC page
IDG.net's Windows software page
IDG.net's personal news page
Questions about computers? Let IDG.net's editors help you
Subscribe to IDG.net's free daily newsletter for computer geniuses (& newbies)
Search IDG.net in 12 languages
News Radio
	Fusion audio primers
	Computerworld Minute

CIH 1.2 is particularly nasty because it has what virus researchers call a dual payload. When it triggers, it first attempts to overwrite your PC's BIOS setup. This works only with a Flash BIOS that can be upgraded via software, and because there's no industry standard way of programming a Flash BIOS, CIH isn't always successful at doing its dirty work. But if it is successful, your PC won't start until the BIOS is reprogrammed.

Whether or not CIH 1.2 is successful at overwriting the BIOS, what it does next is even worse. It overwrites your entire hard disk with random data, erasing all your data and applications.

Getting prepared

The ICSA's Thompson has two suggestions for all PC users: Get your antivirus software up to date, and back up your data.

According to the ICSA, all recent versions of ICSA-certified antivirus software can detect and remove the CIH 1.2 virus. But it's still worthwhile to check the Web site of your antivirus software maker to make sure it detects CIH 1.2. Spot checks of antivirus software sites, including industry leaders Symantec and McAfee, show that current updates do.

And if your PC isn't equipped with antivirus software, what are you waiting for? Several companies, including McAfee, Symantec, and Trend Micro, offer free trial versions of their antivirus software.