[Danus]

Before I start
Im going to write this "series" in various forums that im a member in just pointing it out in case you'll see it.
But the main reason im doing this, is because i want to analyze malware better and this could be a really awesome practice for me from the theory side.

What will be Analyzing
Today we would be checking out a really cool virus that was discovered in 1998 June name the CIH!
But before i even begin explaining what the CIH is i would like explain what a virus is.

A computer virus, much like a biological virus infects hosts,it replicates by injecting its code into a legitimate program thus the code is executed each time the program is run. in this way the virus spreads to other programs until it infects the whole computer.Viruses can infect boot sectors, Drivers and so on.
Viruses can have devastating payloads such as corrupting your whole files data, or just displaying stupid political messages.

So anyway back to the CIH.
The CIH virus or the Chernobyl virus only attacks Windows 9x systems.
It was written in Assembly and caused a damage for over 25 million dollars!
The CIH virus has a unique behavior of infection which earned him the name of "SpaceFiller".
The virus looks for empty spaces in each program, if it found any, it breaks its code into smaller parts and injects itself into those empty spaces thus not increasing the file size, remaining undetectable to anti-viruses.
The first payload, that most victims had was over-writing the first kilobyte of the hard drive with zeros starting at sector 0. this would cause machine damage and the data could be recovered(if your hard drive had more then a few mega-bytes, then only the Master boot record and a few boot sectors would be lost but not the data), but its not possible to boot the computer.
how ever the second payload attempts to overwrite the Flash BIOS which had critical boot time code that was replaced with junk and in that case the computer cannot be recovered unless you change your Flash BIOS chip.

The payload starts in 1999 on April 26th(later variants had payloads on any month)
It is unknown if the virus was named CIH because of its authors name(that still wasn't charged and arrested)Chen Ing-Hau, or because of the payload that starts on 26th of April, the Chernobyl disaster date.
Chen Ing-Hau claims that he didn't want to cause such damage to the world, he just wanted to proof that Anti-Viruses are useless and someone needs to do something about it.

Now a short video by danooct1, which makes amazing malware videos!



I hope you enjoyed this tutorial!
(well it helped me)

"Chen claimed to have written the virus as a challenge against bold claims of antiviral efficiency by antivirus software developers.[2] Chen stated that after the virus was spread across Tatung University by classmates, he apologized to the school and made an antivirus program available for public download; the antivirus program was co-authored with Weng Shi-hao (翁世豪), a student at Tamkang University.[2] Prosecutors in Taiwan could not charge Chen at the time because no victims came forward with a lawsuit.[3] These events led to new computer crime legislation in Taiwan.[2]"

What a cool guy.

[Deque]

Chen really was lucky and I think he didn't deserve this. There is nothing cool in destroying computers, imho.
I watch these virus showcases from danooct1 as well. Pretty good videos.
What do you plan to do in your series?

[Danus]

Chen really was lucky and I think he didn't deserve this. There is nothing cool in destroying computers, imho.
I watch these virus showcases from danooct1 as well. Pretty good videos.
What do you plan to do in your series?

Well ill probably analyze various of malware, botnets, worms, viruses, torjans. everything possible.

[Ligeti]

@Danus I really think that you should work in anti-virus business! I've read threads and posts about malware by you more than what I could read in a book!

Good job

[Danus]

Thanks! i appreciate it haha but i dont know much yet!

[Erion]

I remember fighting this badboy on my win 98 computer (i think, can't remember it too clearly), i even think i have the file that infected that computer somewhere.
Back in the day's we did have an internet connection (56kbit/s) but i got the infection from a floppy disk that had an infected .EXE on it..

I was umm 13 years old back then, not so fluent on English, i remember having a program that could remove CIH from a file and detect it, only problem was that you had to manually copy every damned file, disinfect that copy and then replace it in DOS.. I did that for like 5day's and then i was finally done But it felt so good, that was the first real experience on these things.

Thanks for the trip to the memory lane

[Danus]

Ah sure anytime