W95/CIH.1003.A
| W95/CIH.1003.A |
Destructivity:  Spreading:  Overall risk:
|
| • Detected by virus detection files published: 2/5/2004 | • Type: Virus |
| • Virus characteristics first published: 2/5/2004 | • Spreading mechanism: File Infection |
| • Virus characteristics latest update: 3/30/2004 | • Overall risk: Low |
| • Alias: | • Payload: Overwrites the BIOS and hard disk |
| • Infection type: Microsoft Windows 95/98/98 SE/ME |
| Virus type |
Spreading mechanism |
Destructivity and payload |
Additional descriptions |
Detection and removal |
||||||||||
|
CIH.1003.A will only run on Windows 95/98/ME systems. It installs a file system hook to intercept file opens, specifically on executables, and then attempts to infect them. CIH will infect the executable by copying itself to unused areas of the file so in most cases the file size may not appear to change. CIH also includes tricks for preventing detection by AV scanners. |
||||||||||||||