Talk:CIH (computer virus)

From Wikipedia, the free encyclopedia

 This article is part of WikiProject Malware, an attempt to better organise information in articles related to Malware. If you would like to participate, you can edit the article attached to this page, or visit the project page, where you can join the project and/or contribute to the discussion.

It is not necessary to use professional data-recovery services to recover from the CIH virus; this page < http://www.grc.com/cih.htm > has a free recovery utility written by Steve Gibson.

If someone who is more familiar with wikipedia formatting standards and writing style could add this information? >.>

Contents

[edit] explanation on why file size does not grow

Okay, I don't know everything, but I have done low level programming and have a good understanding of how viruses work, and I have no idea what this page means when it talks about file sizes that don't increase because the virus uses "methods of jumping from processor ring 3 to 0" .. processor ring???

Here's an explanation I found that actually makes sense. Someone feel free to add this in, though not in these exact words unless you enjoy plagiarism.

Files infected by CIH may have the same size as the original files because of CIH's unique mode of infection. The virus will search for empty, unused spaces in the file. Next it will break itself up into smaller pieces and inserts them in these unused spaces.

I'm sure a portion of the virus does become memory resident.. it no doubt has its own ISR .. it no doubt hooks a system call or two, but I have no idea what a processor ring is.

[edit] Contradiction

Is this line not a contradiction?

"By April 26, 2000, much of the damage was happening in Asia, but the virus was not as widespread there."

Also, this article seems to claim the virus was a big disaster and wide spread, but several other sources i have viewed say the virus was mostly contained because it was spotted so early. I don't know which view is correct?

81.110.10.170 15:09, 5 November 2005 (UTC) Oliver Philpott

[edit] Effects Windows XP

I have windows XP, and my computer was defineltly infected with the CIH virus, affecting my BIOS.

  • I need a documented media source stating this. Otherwise we cannot say this. WhisperToMe (talk) 04:14, 4 June 2008 (UTC)

[edit] Under "History"

"It was honar who droped CIH v1.2 into the system as part of its payload." Can anybody tell me what, exactly, that is supposed to say? Ahanix1989 21:15, 1 December 2006 (UTC) Mellisa was a virus, also??