Alias:PE_CIH, CIH, Tschernobyl, Spacefiller
Type:Virus 
Size:varied 
Origin:Taiwan 
Date:08-10-1998 
Damage: 
VDF Version:  
Danger:High 
Distribution:Medium 

General DescriptionW95/CIH is a resident virus that infects Windows programs (PE files). It infects PE files but does not change their size. With the aid of data about the unused fields in these files, it can divide itself in many parts. W95/CIH contains destructive payloads: overwriting BIOS in Flash-ROM and overwriting all the hard drives.

Technical DetailsW95/CIH runs only on Windows 95/98. It only infects 32bit program files (Windows EXEs, PE files). When an infection file is first opened on an uninfected computer system, it enters the PageAllocate memory and there it places a copy of its infectious code. Then it copies the rest of its program parts. Probably because of a mistake in the program, the virus uses 8KB, when 4KB would have been enough.

Last, it “hooks” on the system file (IFSMGR-Hook) and gives the full control over to the main program. Monitoring IFSMGR-Hooks the virus checks all files when opened and has a quick reaction. It uses a little trick that helps to avoid a ‘deep search’ and detects if a file has already been infected: if the last DOS byte (“this program needs Microsoft Windows”) does not equal 00h, the file will not be infected.

The virus “jumps” from Ring 3 (application programs level) directly to Ring 0 (system programs level). On Ring 0 the virus has all system functions at its disposal and here are running its program parts. The virus examines all .exe files and starting with version 1.4, it doesn’t infect the .exe files, which contain in their name the string "nZIP" (the WinZip SelfExtractor checks, if its header and/or its complete section are modified).

When the infection must begin, the virus has all the data it needs: it looks for unused fields (“holes”) in every PE- files section. There must be at least 184 bytes free. Every page uses in Windows 95/98 exactly 512 bytes. If the main program does not use the entire last page in a section, there will remain some unused fields. If the virus will also change the section’s administration information, this will only be mentioned in passing.

After infection, the date is checked, for payload discharging. Then, W95/CIH tries to overwrite both Flash-ROM and the hard disk. Hard disks are accessed and overwritten using direct writing rights (IOS_SendCommand).
Descrizione inserita da Crony Walker su martedì 15 giugno 2004

Indietro . . . .