View source for CIH (computer virus)

{{Short description|Windows 9x computer virus}}
{{For|a similar signature in FAT OEM labels|FAT IHC OEM label}}
{{Infobox computer virus
 |  | image=CIH.png
 | caption=Antivirus intercept message on a Windows 95 system}}
'''CIH''', also known as '''Chernobyl''' or '''Spacefiller''', is a [[Windows 9x|Microsoft Windows 9x]] [[computer virus]] that first emerged in 1998. Its payload is highly destructive to vulnerable systems, overwriting critical information on infected system drives and, in some cases, destroying the system [[BIOS]]. The virus was created by Chen Ing-hau (陳盈豪, [[pinyin]]: ''Chén Yíngháo''), a student at [[Tatung University]] in [[Taiwan]].<ref name=ithome>{{cite web | title=從CIH「重裝駭客」變身「除錯超人」 | website=iThome online | date=2006-08-25 | url=http://www.ithome.com.tw/itadm/article.php?c=38975 | archive-url=https://web.archive.org/web/20130417062110/http://www.ithome.com.tw/itadm/article.php?c=38975 | archive-date=2013-04-17 | url-status=dead | language=zh}}</ref> It was believed to have infected sixty million computers internationally, resulting in an estimated {{currency|1 billion|TWD|passthrough=yes}} ({{currency|{{To USD|1000000000|TWN}}|USD}}) in commercial damages.<ref name=ithome/>

Chen claimed to have written the virus as a challenge against bold claims of antiviral efficiency by [[antivirus software]] developers.<ref name=parenting>{{cite web | title=從駭電腦到愛旅行─昔日網路小子陳盈豪 - 親子天下雜誌8期 - 陳盈豪,網路世界,宅男,網路沉迷 | website=parenting.com.tw | date=2013-06-07 | url=http://www.parenting.com.tw/article/article.action?id=5020407 | archive-url=https://web.archive.org/web/20130607045905/http://www.parenting.com.tw/article/article.action?id=5020407 | archive-date=2013-06-07 | url-status=dead | language=zh}}</ref> Chen stated that after classmates at Tatung University spread the virus, he apologized to the school and made an antivirus program available for public download. Weng Shi-hao (翁世豪), a student at [[Tamkang University]], co-authored with the antivirus program.<ref name=parenting/> Prosecutors in Taiwan could not charge Chen at the time because [[Antragsdelikt|no victims]] came forward with a lawsuit.<ref>{{cite web | title=打擊駭客，不再無法可施 - 安全常識 - 法務部行政執行署嘉義分署 | publisher=行政執行署嘉義行政執行處 | date=2005-12-10 | url=http://www.cyy.moj.gov.tw/ct.asp?xItem=24238&ctNode=13535 | archive-url=https://web.archive.org/web/20131029210313/http://www.cyy.moj.gov.tw/ct.asp?xItem=24238&ctNode=13535 | archive-date=2013-10-29 | url-status=unfit | language=zh }}</ref> Nevertheless, these events led to new [[Cybercrime|computer crime]] legislation in Taiwan.<ref name=parenting/>

The name "Chernobyl Virus" was coined sometime after the virus was already well known as CIH and refers to the complete coincidence of the payload trigger date in some variants of the virus (actually the virus creation date in 1998, to trigger exactly a year later) and the [[Chernobyl disaster]], which happened in the [[Soviet Union]] on April 26, 1986.<ref name="auto">{{Cite web |title=What is the Chernobyl Virus? (with pictures) |url=http://www.easytechjunkie.com/what-is-the-chernobyl-virus.htm |access-date=2023-02-16 |website=Easy Tech Junkie |language=en-US}}</ref>

The name "Spacefiller" was introduced because most viruses write their code to the end of the infected file, with infected files being detectable because their file size increases. In contrast, CIH looks for gaps in the existing program code, where it then writes its code, preventing an increase in file size; in that way, the virus avoids detection.<ref name="auto"/>

==History==
The virus first emerged in 1998. In March 1999, several thousand [[IBM]] [[IBM Aptiva|Aptivas]] shipped with the CIH virus,<ref>{{cite web | last=Weil | first=Nancy | title=Some Aptivas shipped with CIH virus | website=CNN | date=1999-04-07 | url=http://www.cnn.com/TECH/computing/9904/08/aptivirus.idg/index.html | archive-url=https://web.archive.org/web/20070104171525/http://www.cnn.com/TECH/computing/9904/08/aptivirus.idg/index.html | archive-date=2007-01-04 | url-status=live}}</ref> just one month before the virus would trigger. In July 1999, copies of [[remote administration tool]] [[Back Orifice 2000]] given out to [[DEF CON]] 7 attendees were discovered by the organizers to have been infected with CIH.<ref>{{cite web | title=Back Orifice CDs infected with CIH virus - Tech News on ZDNet | website=[[ZDNet]] | date=July 14, 1999 | url=http://news.zdnet.com/2100-9595_22-515160.html | archive-url=https://web.archive.org/web/20070311051432/http://news.zdnet.com/2100-9595_22-515160.html | archive-date=2007-03-11 | url-status=dead}}</ref> On December 31, 1999, [[Yamaha Corporation|Yamaha]] shipped a software update to their CD-R400 drives that was infected with the virus. In July 1998, a [[Game demo|demo]] version of the [[first-person shooter]] game ''[[Sin (video game)|Sin]]'' was infected by one of its mirror sites.<ref>{{cite web | title=US Report: Gamers believe Activision's 'SiN' carries CIH virus | website=ZDNet.co.uk | date=28 Jul 1998 | url=http://news.zdnet.co.uk/security/0,1000000189,2068990,00.htm | archive-url=https://web.archive.org/web/20090417075559/http://news.zdnet.co.uk/security/0,1000000189,2068990,00.htm | archive-date=2009-04-17 | url-status=dead}}</ref>

CIH's dual payload was delivered for the first time on April 26, 1999, with most of the damage occurring in [[Asia]].<ref>{{Cite web |last=Lemos |first=Robert |date=May 25, 1999 |title=Is the CIH virus on the endangered list? |url=https://www.zdnet.com/article/is-the-cih-virus-on-the-endangered-list/}}</ref> CIH filled the first 1024 [[kilobyte|KB]] of the host's [[boot drive]] with zeros and then attacked certain types of [[BIOS]]. Both of these payloads served to render the host computer inoperable, and for most ordinary users, the virus essentially destroyed the PC. Technically, however, it was possible to replace the [[BIOS chip]],{{citation needed|date=May 2024}} and methods for recovering [[Hard disk drive|hard disk]] data emerged later.{{citation needed|date=May 2024}}

The virus made another comeback in 2001 when a variant of the [[ILOVEYOU|LoveLetter Worm]] in a [[VBScript|VBS]] file that contained a dropper routine for the CIH virus was circulated around the internet under the guise of a nude picture of [[Jennifer Lopez]].

A modified version of the virus called CIH.1106 was discovered in December 2002, but it is not widespread and only affects Windows 9x-based systems.<ref>{{Cite web|title=Virus:DOS/CIH|url=https://www.f-secure.com/v-descs/cih.shtml|url-status=live|access-date=2021-12-07|website=F-Secure Labs|language=en|archive-url=https://web.archive.org/web/20010128151200/http://www.f-secure.com:80/v-descs/cih.shtml |archive-date=2001-01-28 }}</ref>

==Virus specifics==
{{unsourced section|date=October 2021}}

CIH spreads under the [[Portable Executable]] file format under the Windows 9x-based operating systems, Windows 95, 98, and ME. CIH does not spread under [[Windows NT]]-based operating systems nor Win16-based operating systems such as [[Windows 3.x]] or below.<ref>{{Cite web |title=Virus:DOS/CIH {{!}} F-Secure Labs |url=https://www.f-secure.com/v-descs/cih.shtml |access-date=2023-11-05 |website=www.f-secure.com |language=en}}</ref>

CIH infects Portable Executable files by splitting the bulk of its code into small slivers inserted into the inter-section gaps commonly seen in PE files and writing a small re-assembly routine and table of its own code segments' locations into unused space in the tail of the PE header. This earned CIH another name, "Spacefiller". The size of the virus is around 1 [[kilobyte]], but due to its novel multiple-cavity infection method, infected files do not grow at all. It uses methods of jumping from processor [[Protection ring|ring]] 3 to 0 to hook system calls.

The payload, which is considered extremely dangerous, first involves the virus overwriting the first [[megabyte]] (1024KB) of the [[Hard disk drive|hard drive]] with zeroes, beginning at [[Disk sector|sector]] 0. This deletes the contents of the [[Master boot record#Sector layout|partition table]], and may cause the machine to [[Hang (computing)|hang]] or cue the [[Blue Screen of Death|blue screen of death]].

The second payload tries to write to the Flash [[BIOS]]. BIOSes that can be successfully written to by the virus have critical boot-time codes replaced with junk. This routine only works on some machines. Much emphasis has been put on machines with motherboards based on the [[Intel]] [[List of Intel chipsets#Pentium chipsets|430TX]] [[chipset]], but by far the most important variable in CIH's success in writing to a machine's BIOS is the type of Flash ROM chip in the machine. Different Flash ROM chips (or chip families) have different write-enable routines specific to those chips. CIH makes no attempt to test for the Flash ROM type in its victim machines and has only one write-enable sequence.

For the first payload, any information that the virus has overwritten with zeros is lost. If the first partition is [[File Allocation Table|FAT32]], and over about one [[gigabyte]], all that will get overwritten is the [[Master boot record|MBR]], the partition table, the [[boot sector]] of the first partition and the first copy of the FAT of the first partition. The MBR and boot sectors can simply be replaced with copies of the standard versions; the partition table can be rebuilt by scanning over the entire drive and the first copy of the FAT can be restored from the second copy. This means a complete recovery with no loss of user data can be performed automatically by a tool like [http://www.grc.com/cih.htm Fix CIH].

If the first partition is not FAT32 or is smaller than 1 GB, the bulk of user data on that partition will still be intact, but without the [[root directory]] and FAT it will be difficult to find it, especially if there is significant fragmentation.

If the second payload executes successfully, the computer will not start at all. Reprogramming or replacement of the Flash BIOS chip is then required, as most systems that CIH can affect predate BIOS restoration features.

===Variants===
{| class="wikitable"
! Moniker
! Description
|-
|CIH v1.2/CIH.1003
|This variant is the most common one and activates on April 26. It contains the string: {{mono|CIH v1.2 TTIT}}
|-
|CIH v1.3/CIH.1010.A and CIH1010.B
|This variant also activates on April 26. It contains the string: {{mono|CIH v1.3 TTIT}}
|-
|CIH v1.4/CIH.1019
|This variant activates on the 26th of any month. It contains the string {{mono|CIH v1.4 TATUNG}}.
|-
|CIH.1049
|This variant activates on August 2 instead of April 26.
|}

==See also==
{{Portal|1990s|Taiwan}}
*[[Comparison of computer viruses]]
*[[Timeline of computer viruses and worms]]

==References==
{{Reflist}}

==External links==
* [https://web.archive.org/web/20060615003121/http://www.f-secure.com/cih/ F-Secure CIH Database]
* [http://www.f-secure.com/v-descs/cih.shtml F-Secure CIH Technical Page]
* [https://web.archive.org/web/20061129201750/http://www.symantec.com/security_response/writeup.jsp?docid=2000-122010-2655-99 Symantec CIH Technical Page]
* [https://web.archive.org/web/20050310055951/http://news.zdnet.co.uk/hardware/emergingtech/0%2C39020357%2C2088013%2C00.htm News article about the Jennifer Lopez e-mail]
* [http://www.grc.com/cih/cih.htm FIX-CIH] - Site by [[Steve Gibson (computer programmer)|Steve Gibson]] on how to repair most of the damage from CIH
* [https://github.com/onx/CIH CIH 1.4 source code]

{{Hacking in the 1990s}}

{{DEFAULTSORT:Cih (Computer Virus)}}
[[Category:Windows file viruses]]
[[Category:Hacking in the 2000s]]
[[Category:Hacking in the 1990s]]
[[Category:Taiwanese inventions]]