ad info
   personal technology

 custom news
 Headline News brief
 daily almanac
 CNN networks
 CNN programs
 on-air transcripts
 news quiz

CNN Websites
 video on demand
 video archive
 audio on demand
 news email services
 free email accounts
 desktop headlines

 message boards




CIH virus antidote author defends his program

May 20, 1999
Web posted at: 1:18 p.m. EDT (1718 GMT)

by Sanjit Singh

Windows TechEdge

virus graphic

   IN-DEPTH SPECIAL: Insurgency on the Internet

   Sign up for the Computer Connection email service

   For more computing stories


(IDG) -- A 21-year-old Bangladeshi student who invented an antidote for the CIH, or Chernobyl, virus has declared that his software is safe, despite concern about the program voiced by professional antivirus authors.

Developers at U.S. data recovery firm OnTrack Data International Inc. said that users of the free utility, called MRECOVER -- written by Bangladeshi student Monirul Islam Sharif -- might be in danger of losing fully recoverable critical data.

OnTrack's criticism, however, is not about the core MRECOVER program, but the readme.txt file that comes with it, Sharif stressed.

The Chernobyl or CIH virus, invented by one-time Taiwanese student Chen Ing-hau, caused havoc all over Asia on April 26, hitting thousands of PCs in Korea, Singapore, India, Bangladesh, and China.

After the virus hit, Sharif said, he wrote a 70KB C-language antidote program, which he called MRECOVER, in 24 hours, and posted it on his Web site.

  Windows Tech Edge home page
  Make your PC work harder with these tips
 Reviews & in-depth info at
 *'s personal news page's products pages
  Year 2000 World
  Questions about computers? Let's editors help you
  Subscribe to's free daily newsletters
  Search in 12 languages
 News Radio
 * Fusion audio primers
 * Computerworld Minute

OnTrack engineer Sean Barry, however, said that users may be putting themselves at greater risk of losing data if they follow instructions appearing in the program's accompanying text files. Barry noted that if the utility does not recover the data, the instructions in the program tell users that they may have to format their storage device. The problem with the text instructions as they now read, according to OnTrack's Barry, is that if users reformat their hard drives, professionally written programs that otherwise may have been able to recover all the lost data may not be able to.

OnTrack said it recommended that if users decide to use shareware or freeware utilities to recover from the CIH virus, they should avoid re-partitioning or reformatting their storage device if the utility does not work. The firm said its data recovery engineers have recovered useable data for worldwide customers who have suffered data loss from the CIH virus. In most cases, it has been a 100 percent recovery from the virus corruption, OnTrack said.

Sharif, for his part, said OnTrack is harping on the semantics of the text of the readme.txt file accompanying his program and not the program itself.

"I have got lots of feedback from users all over the world since I posted MRECOVER at on May 2," he said. He added, however, that, "I accept that in my program, near the end of recovery, it shows a message 'If data recovery is not possible you may have to format.'"

Sharif said that he would change the readme.txt file accompanying the next version of the program to make it clearer that the program does not always work and to avoid misunderstanding on the part of users.

Meanwhile, Sharif said, "I have also mentioned on the Web site, 'MRECOVER will not alter the contents of the disk if it sees data is not recoverable, only when MRECOVER can retrieve data, it will write the changes.' This ensures that the contents are intact and that you can use other methods if available."

The MRECOVER program currently will not recover the first partition of a hard drive if the hard drive uses File Allocation Table (FAT) 16, but the text files accompanying the program clearly say that, Sharif noted.

Additional reporting by Marc Ferranti in New York. The authors write for IDG News Service, a Windows TechEdge affiliate.

"Chernobyl" virus

Student touts 'Chernobyl' cure
May 12, 1999
Chernobyl virus wreaks havoc in parts of Asia
April 27, 1999
Chernobyl virus hits just a few, but very hard
April 26, 1999

CIH virus dangerous but easy to avoid
CIH 1.2 virus hits few
Spotted in the wild: a virus that damages hardware
An antidote for CIH virus?
Vendor lab to start rating virus threats
Note: Pages will open in a new browser window
External sites are not endorsed by CNN Interactive.

The CIH virus antidote
OnTrack Data
Note: Pages will open in a new browser window
External sites are not endorsed by CNN Interactive.
Enter keyword(s)   go    help

Back to the top   © 2001 Cable News Network. All Rights Reserved.
Terms under which this service is provided to you.
Read our privacy guidelines.