To: MadMatt who wrote (3543 ) 7/25/1998 1:33:00 PM From: MadMatt Read Replies (1) | Respond to of 4539
OFF TOPIC Saw this elsewhere and thought everyone should know about it. Don't know if it's legit but worth reading By: lsmorrison Reply To #1477 by Phaedo Friday, 24 Jul 1998 , 10:00 PM EDT Post # of 1480 Yes I can it is the CHI-REM virus.... it is suposed to fill up your hd with junk. Date: July 23, 1998 06:40 AM Author: Network Associates Online Support (support@nai.com) Subject: W32.CIH.SPACEFILLER info W32.CIH.Spacefiller AKA Win95.CIH Virus Aliases: PE CIH, WIN/95 CIH Area of Infection: Windows 95 portable Executable files (PE) Characteristics: EXE, Windows, Memory Resident Payload Date: 26th of the month Origin: Taiwan, found in early June 1998 Variants: CCIH 1.2 TTIT, CCIH 1.3TTIT, CCIH 1.4 Tatung (version 1.2 and 1.3 activate on April 26th, version1.4 will activate on the 26th of any month) The W32.CIH.Spacefiller virus originated in Taiwan in early June 1998 and within one week was worldwide. The virus infects Windows 95 and 98 executable files and will quickly infect all the files of this type it can find . When an infected file is run, the virus becomes memory resident. It will then infect other files when they are copied or opened. Infected files will be the same size as the original file because of the unique infection techniques used, so this makes the virus difficult to detect. The virus will first look for empty spaces in the file, then it will break itself up into small fragments and hide in the file. However the virus has some bugs, and in some cases can crash your computer, when infected applications are run. The virus has two payloads, though McAfee Labs has yet to produce either one in its tests. It can overwrite or delete information on the hard drive by using direct disk-writes calls, bypassing standard BIOS virus protection, while overwriting the MBR and boot sectors. The other payload will reportedly overwrite certain flash BIOS chipsets on some machines from a 486 through a Pentium II, which have flash BIOS. Some computers have a jumper on the motherboard, which acts as hardware write protection. Some machines also have a DIP switch, which allows the flashing BIOS to be disabled. There are some newer computers that cannot be protected by the switch and therefore are vulnerable to the virus. If this payload executes it will leave the PC inoperable unless the BIOS is restored or replaced. McAfee Labs is continuing to analyze the virus and will update this document as necessary. To be protected please be sure to download the latest DAT file (3107a) and the SFREM.EXE cleaner. Length Text ---- Name Trigger date Found In-The-Wild 1003 CCIH 1.2 TTIT on April 26th YES 1010 CCIH 1.3 TTIT on April 26th NO 1019 CCIH 1.4 TATUNG on 26th of any month YES - many reports Network Associates Online Support To get the beta dats see: beta.nai.com Help this is on my comp. right now. And I am having problems geting it off. Linda