F-Secure warns: CIH virus about to activate again

The most destructive virus ever will activate on April 26

Espoo, Finland - April 19, 2000

Espoo, April 19, 2000 - F-Secure Corporation [HEX: FSC], a leading provider of security for mobile, distributed enterprises, reminds computer users about the CIH virus (also known as Chernobyl), which activates every year on April 26th. F-Secure Anti-Virus detects and disinfects the virus.

When CIH activated last time, in April 1999, it caused the biggest ever damage done by a virus. According to the latest statistics, over two million PCs suffered data loss because of the CIH virus last year.

The biggest damages last year occurred in Asia, and according to Mikko Hypponen, Manager of Anti-Virus Research at F-Secure, this might happen again. "We are not expecting catastrophes in North America or Europe," Hypponen continues. "Most of the infected machines in these areas are isolated home machines. However, the situation is different in Asia, where the CIH virus is still widespread in corporate computers as well. In any case, CIH damages in 2000 will not be nearly as big as they were in 1999."

According to WildList - a list of viruses known to be causing real-world incidents - CIH has been reported in the wild recently by 39 of the 55 worldwide WildList correspondents.

The CIH 1.2 virus does not constitute a risk to users of DOS, Windows 3.x, Windows NT, Windows 2000 or Macintosh. The virus only replicates and activates under Windows 95 and Windows 98. The virus can overwrite the hard disk and the flash BIOS of an infected computer when it activates on April 26 -- causing complete loss of data, and possibly rendering the computer unusable.

According to Hypponen, CIH activation will not become nearly as serious a problem as it was in 1999: "Although CIH is still an in-the-wild virus, most infected machines were overwritten a year ago, when the virus activated last time. When CIH overwrites a hard drive, it overwrites its own code as well, effectively killing itself".

What users should do

According to Hypponen, if a user's computer is protected with anti-virus software and the software has been updated during last year, problems are unlikely to occur, as the software should detect the virus. However, he advises users to double-check and make sure their software is up to date and able to detect CIH, and to make back-ups of important data. If in any doubt, download free anti-virus tools from the F-Secure website now. The Global CIH Information Center is at:

http://www.F-Secure.com/cih/