New Chernobyl virus strain detected

December 4, 2002

Panda Software, a Spanish-based antivirus company, reports the appearance of a new strain of the devastating W95/CIH10XX virus – also known as the Chernobyl virus - which can be so damaging to some computers that it will render some BIOS chips and even entire motherboards, unusable.

Panda somehow obtained a copy of the new Chernobyl variant, though it is not been seen "in the wild".

According to the Panda report the virus deletes the contents of the hard disk and prevents infected computers from being booted. To carry out its infection, CIH.1106 goes memory resident on affected systems.

On Windows 98, Windows 95 or Millennium computers, the strain waits for files with an EXE extension to be run and spreads its infection code in the unused spaces in these files. In this way, the size of infected files does not increase, which avoids arousing suspicion. However, on computers with Windows 2000, NT or XP operating systems, the virus stays memory resident but does not infect files.

The virus activates its payload on the 2nd of every month. The original variant, first detected in 1998, activates its payload on the 26th of April, the date of the Chernobyl nuclear catastrophe.

Another antivirus vendor, while admitting the threats posed by the new strain, urged calm. Allan Bell, of Asia-Pacific of Network Associates points out that "...unless the virus is being seen in the wild there is a danger of ’crying wolf.’"

Bell told that even though this new strain is very dangerous the risk factor for a virus must consider its prevalence. This new variant of the Chernobyl virus has not been reported to be in the wild and so the average user is not likely to encounter it."

To prevent infection with CIH.1106, Panda advises users to update their antivirus software.