Threat behavior
Win95/CIH infects Win32 PE-format executable files. When an infected program is started, the virus runs first. The virus takes the following actions when it runs:
- Installs itself in memory.
- Installs file-system intercepts so that the virus is called whenever a file is accessed.
- Checks the system date to determine whether to activate the payload. Depending on the variant, the trigger date for payload activation is one of the following:
- Performs the following operations on the payload trigger date:
- Overwrites the boot disk with random data. The computer cannot be rebooted after this occurs.
- Attempts to overwrite the Flash BIOS with random data. If this attempt succeeds, the Flash BIOS or entire motherboard may need to be replaced.
- Passes control to the original infected program, which then runs normally.
- Infects any .exe file accessed by an application or the operating system if the virus is still in memory and the file is not already infected. Upon infection, the virus takes the following actions on the file:
- Stores itself between sections in unused portions of the file, so the file does not increase in size after being infected.
- Places a marker at a certain location in the file.
When removing the virus, some antivirus products leave the infection marker in the file so that the virus does not re-infect the file at a later time.
Prevention
Take the following steps to help prevent infection on your system:
-
Enable a firewall on your computer.
-
Get the latest computer updates.
-
Use up-to-date antivirus software.
Enable a firewall on your computer
Use a third-party firewall product or turn on the Microsoft Windows XP Internet Connection Firewall.
To turn on the Internet Connection Firewall in Windows XP
-
Click Start, and click Control Panel.
-
Click Network and Internet Connections, and click Network Connections. If you do not see Network and Internet Connections, click Switch to Category View.
-
Highlight a connection that you want to help protect, and click Change settings of this connection.
-
Click Advanced, and select Protect my computer and network by limiting or preventing access to this computer from the Internet.
-
Click OK.
Get the latest computer updates
Updates help protect your computer from viruses, worms, and other threats as they are discovered. You can use the Automatic Updates feature in Microsoft Windows XP to automatically download future Microsoft security updates while your computer is on and connected to the Internet.
To turn on Automatic Updates in Windows XP
-
Click Start, and click Control Panel.
-
Click Performance and Maintenance. If you do not see Performance and Maintenance, click Switch to Category View.
-
Click System.
-
Click Automatic Updates, and select Keep my computer up to date.
-
Select a setting. Microsoft recommends selecting Automatically download the updates, and install them on the schedule that I specify and setting a regular update time.
-
If you choose to have Automatic Updates notify you in step 5, you will see a notification balloon when new downloads are available to install. Click the notification balloon to review and install updates.
Use up-to-date antivirus software
Most antivirus software can detect and prevent infection by known malicious software. You should always run antivirus software on your computer that is updated with the latest signature files to automatically help protect you from infection. If you don't have antivirus software installed, you can get it from one of several companies. For more information, see http://www.microsoft.com/athome/security/downloads/default.mspx
