W95/CIH - Malware

Vedi anche

Descrizione completa

Alias:	PE_CIH, CIH, Tschernobyl, Spacefiller
Type:	Virus
Size:	varied
Origin:	Taiwan
Date:	08-10-1998
Damage:
VDF Version:
Danger:	High
Distribution:	Medium

General DescriptionW95/CIH is a resident virus that infects Windows programs (PE files). It infects PE files but does not change their size. With the aid of data about the unused fields in these files, it can divide itself in many parts. W95/CIH contains destructive payloads: overwriting BIOS in Flash-ROM and overwriting all the hard drives.

Technical DetailsW95/CIH runs only on Windows 95/98. It only infects 32bit program files (Windows EXEs, PE files). When an infection file is first opened on an uninfected computer system, it enters the PageAllocate memory and there it places a copy of its infectious code. Then it copies the rest of its program parts. Probably because of a mistake in the program, the virus uses 8KB, when 4KB would have been enough.

Last, it hooks on the system file (IFSMGR-Hook) and gives the full control over to the main program. Monitoring IFSMGR-Hooks the virus checks all files when opened and has a quick reaction. It uses a little trick that helps to avoid a deep search and detects if a file has already been infected: if the last DOS byte (this program needs Microsoft Windows) does not equal 00h, the file will not be infected.

The virus jumps from Ring 3 (application programs level) directly to Ring 0 (system programs level). On Ring 0 the virus has all system functions at its disposal and here are running its program parts. The virus examines all .exe files and starting with version 1.4, it doesnt infect the .exe files, which contain in their name the string "nZIP" (the WinZip SelfExtractor checks, if its header and/or its complete section are modified).

When the infection must begin, the virus has all the data it needs: it looks for unused fields (holes) in every PE- files section. There must be at least 184 bytes free. Every page uses in Windows 95/98 exactly 512 bytes. If the main program does not use the entire last page in a section, there will remain some unused fields. If the virus will also change the sections administration information, this will only be mentioned in passing.

After infection, the date is checked, for payload discharging. Then, W95/CIH tries to overwrite both Flash-ROM and the hard disk. Hard disks are accessed and overwritten using direct writing rights (IOS_SendCommand).

Per la descrizione "in breve" clicca qui.

Descrizione inserita da Crony Walker il Tue, 15 Jun 2004 14:00 (GMT+1)

» Informazioni sul malware
» Informazioni sul phishing
» Viruses In the Wild

« Indietro