Logo

Company News
Press Release #31

Date : Apr 26, 1999
Tel. : 137-0150, 135-6253

Win95.CIH virus reaped a rich harvest having annihilated information on many Russian computers

On April 26, 1999 Win95.CIH, a computer virus that deletes data from hard drive, comes into effect on many Russian computers. In some cases it is possible to repare the computer only with the help of some special equipment or technical support service. In most cases all the data lost can not be restored.

DialogueScience's, Inc technical support service during 9 working hours from the morning of April 26 received about 500 calls and over 100 e-mails from more than 22 Russian cities about Win95.CIH activating. In recent years it is the most serious occurrence of virus activating especially the one causing data losses and making computers run out of order.

Some details. On April 26 after Windows 95/98 is started the virus detects the necessary date and activates destructive function. The function:

  1. tries to write "rubbish" into computer's FLASH BIOS. If the operation is performed successfully, one may restore the computer only by changing BIOS chip or by updating it on the special equipment. Unfortunately, sometimes it is practically impossible. In particular, in some types of portable computers it will be necessary to change the motherboard that may cost you the price of a new computer;
  2. deletes data from the drives overwriting it with casual "rubbish".
It is nearly impossible to restore data from the drives. Anyway, as the result computer does not start loading and it often looks like a breakage. During the first half of the working day on April 26, 1999 over 50 clients, sure that the power supply unit is out of order, turned to the technical support service of Red wave, a firm dealing with computer assembling and sale.

The virus was created a year ago in Taiwan. During the last year it spread worldwide, including Russia. According to ICSA (International Computer Association), in 1998-1999 Win95.CIH virus is surely entering the top ten of the most worldwidely spread viruses. And from the ten Win95.CIH is the only one having seriously destructive functions. It is activated once a year - on the 26th of April. Some modifications created later activate on the 26th every month.

On the whole Win95.CIH virus is known for long. Antivirus programs, including Doctor Web by DialogueScience, know it already for a while and are able to cure it. But, naturally, before the virus is activated and bury itself all the data. The point is that in practice the majority of users, despite being warned, do not use antivirus programs. Moreover, many of the victims had more or less new antivirus program versions but they did not run them to check the hard drives. And nevertheless the virus was activated!

A usually given advice like "do not use unchecked sources", "regularly check drives with antivirus programs" do help in such cases. Those who care about data safety and use latest antivirus program versions are protected from such virus attacks. Thus, there were no victims discovered among DialogueScience's regular clients.

DialogueScience, Inc released a free Doctor Web for Windows 95/98/NT version, that can detect and cure the viruses of Win95.CIH family. The commercial Doctor Web for DOS version also detects and deletes the viruses of this family successfully but when Windows is started it does not see the viruses in the Windows system memory that's why we strongly recommend to run the DOS version only from a "clean" DOS.

For those who would like to check their computer and drives DialogueScience offers a free Doctor Web for Windows 95/98/NT version on the Internet servers or in the office. Servers' addresses:

DialogueScience Information Service
E-mail: antivir@DIALS.ru
http://www.antivir.ru
Back Press-release list   Back Home page
Back Free download   Back Commercial info
Copyright © 1999 DialogueScience, Inc., Moscow, Russia. All rights reserved.