The Taming of the Shrew CIH
More recently, on April 26, we witnessed the massive destruction of computers (the destruction of CMOS content) and the destruction of information on hard drives. The blow to the pocket of computer owners was quite tangible. The virus was made Win95.CIH. The next awakening of this virus (more precisely, its two varieties: CIH.1010.B and CIH.1019) is expected on June 26. But how many of us made the right conclusions from what happened on April 26? And what, in fact, need to draw conclusions?
Let me briefly recall what happened.
What happened on April 26
On April 26, the destructive properties of the main (and, by the way, the most common in Kiev) version of the CIH.1003 virus became more active.
Destruction caused by the virus:
The first 2048 sectors of each hard drive are destroyed, and a random sequence is written in their place.
Part of the BIOS contents is destroyed.
As a result: a very large number of computers on this day turned out to be inoperative. A queue of people wishing to write the BIOS or restore information on the hard drive was lined up in the EPOS service center. Many did not know or did not believe in the possibility of recovering information and hurried to reinstall the operating system. With the inevitable, alas, loss of all your data. Partly this was facilitated by some statements in the press and on television about the fact that it is impossible to recover information after the Win95.CIH virus has “worked”. In fact, the circumstances were different. The statistics of the hard drives and BIOS chips that arrived at the service center (including motherboards and assembled computers) for the first 10 days after April 26 are given.
It can be seen that the blow inflicted by the Win95.CIH virus was very noticeable. The least affected were those who were serious about creating and storing backup copies of information. They, at least, did not need to recover disks. The owners of computers that timely updated their anti-virus tools and regularly checked their computers were not affected.