Necropolis Online
Virus Infomation



Virus Watch

Featured Virus

Help is on the Way		  

Most Frequently Reported Viruses

1.
2.
3.
4.
5.
6.
7.
8.
9.
10
   WM/Concept.A
Form.A
AntiEXE.A
One_Half.3544
Junkie.1027.A
Empire.Monkey.B
AntiCMOS.A
Parity_Boot.B
WM/CAP.A
WM/Npad.A


Featured Virus

Updated Weekly

VirusName:   W95.CIH
Aliases:   PE_CIH
Infection Length:   ~1K
Area of Infection:   Windows 95/98 Portable Executable (PE) files
Likelihood:   Rare
Region Reported:   ?
Characteristics:   EXE, Windows, Memory Resident
Target Platform:   Windows 95/98
Target Date:   26th of the month

Description:

W95.CIH is a virus that infects 32-bit Windows 95/98/NT executables (files with an .EXE extension), however it will only run on Windows 95/98. When an infected program is run, the virus goes memory resident. W95.CIH then infects new files when they are opened (e.g. when they are run or copied). This means that an infected system must be rebooted from a clean system disk before scanning with any anti-virus product -- if this is not done, the virus will infect every file that the anti-virus product scans.

W95.CIH does not infect Windows 3.x executable files.

W95.CIH has a destructive payload. Some variants of the virus activate on April 26th or June 26th, while other variants will activate on the 26th of every month. This virus will attempt to modify or corrupt certain types of Flash BIOS. We believe that the likelihood is that most computers will not be susceptible to this attack. This information has been corroborated by researchers from the IBM Watson Research Center.

Infected files will be the same size as the original files, due to W95.CIH's unique mode of infection: The virus infects as follows: first, it looks for empty, unused spaces in the file; then, it breaks itself up into smaller pieces, and hides in these unused spaces.