CIH virus can overwrite infected PCs' hard disks and BIOS - potentially the most destructive virus activation ever

Espoo, Finland, March 18, 1999. - Data Fellows, one of the world’s leading developers of anti-virus and encryption software, is warning computer users about a virulent and widespread virus which activates on April 26th 1999 -- the day before Europe's leading IT security show, InfoSecurity '99 opens in London.

The virus is CIH 1.2, a strain of the Win95/CIH virus family. CIH 1.2 (also known as CIH.1003) can overwrite the hard disk and the flash BIOS of an infected computer when it activates on 26th April -- causing complete loss of data, and possibly rendering the computer unusable. Data Fellows is advising all computer users to update their anti-virus software immediately and back up their data.

According to Mikko Hypponen, Manager of Anti-Virus Research at Data Fellows, users should be aware of the CIH virus as it is particularly widespread on the Internet and in other media. "CIH has been quickly distributed worldwide through pirated software and accidental infection of several popular commercial websites. CIH infects Windows 95 and 98 EXE files, and when these are executed the virus will stay in memory and will infect other programs as they are accessed. CIH has been one of the ten most common viruses in the world for some time already.

"What makes CIH serious is that it is very destructive. When activated, the virus overwrites most of the data on the computer's hard drive, and will try to overwrite the flash BIOS chip of the machine. If this succeeds, the machine will be unable to boot at all, and will be unusable unless the chip is reprogrammed by a specialist," he said. ”This virus is potentially more destructive than for example the famous Michelangelo. We hope we can warn people in time and make the 26th of April a non-event."

Although Hypponen points out that the BIOS attack will only work on certain Pentium machines the attack on the hard disk would succeed on every infected machine.

What users should do

According to Hypponen, if a user's computer is protected with anti-virus software and the software has been updated in 1999, problems are unlikely as the software should detect the virus. However, he advises that users double-check their software is up to date and able to detect CIH, and that they make back-ups of important data.

Data Fellows has set up advisory hotlines for both IT users and resellers, giving more information on CIH at +1 408 938-6700 and at +358 9 8599 0544.

Free evaluation copies of F-Secure Anti-Virus are available at http://www.F-Secure.com

A free DOS version is available at ftp://ftp.F-Secure.com/f-prot/free/

Data Fellows F-Secure Anti-Virus software

F-Secure Anti-Virus is the first anti-virus solution to use two virus scanning programs in one. Based on the simple principle of what one scan may miss, another will find, F-Secure Anti-Virus is claimed to have far better virus detection rates than the competition. it provides automatic reporting, alerting and quarantine for the virus.