Introduce "426" virus.

1On April 26th, 999, a shocking epidemic of CIH virus broke out in China, but on April 26th, 2000, the tragedy of CIH virus was staged again in China. Is CIH a pain for computer users in China?

What is CIH virus?

CIH virus is recognized as the first virus that can destroy computer system hardware, and it is also the deadliest virus in malignant viruses. At present, the main communication channels are Internet and email. CIH virus only infects Windows 95/98 operating system. From a technical point of view, CIH virus has achieved a perfect combination with Windows 95/98 operating system. The virus is compiled by VxD (Virtual Device Driver) technology. VxD is the core of Windows 95/98, so it has strong real-time and concealment.

So far, there are as many as five kinds of "protozoa" and "variants" of CIH virus. The "variant" of CIH virus will not only increase the number of infected files, but also be extremely destructive. The three main variants of this virus are: CIHv 1.2, which broke out on April 26th; CIHv 1.3, onset on June 26th; CIHv 1.4, which occurs on 26th of every month.

CIH attack phenomenon

1, attack BIOS

The most unusual thing about CIH virus is its attack on computer BIOS. When CIH attacks, they will try to write spam into the BIOS, and the contents in the BIOS will be completely washed away, which will cause the computer to fail to start. According to the test, CIH can destroy dozens of common BIOS in the market. Therefore, it will bring devastating consequences to many computer users.

Step 2 Overwrite the hard disk

Writing junk content to the hard disk is also one of the destructiveness of CIH. When CIH occurs, IOS SendCommand is called to directly access the hard disk, and garbage code is written to the hard disk in units of 2048 sectors until all data of the hard disk (including logical disk) is destroyed.

Recover the infected hard disk

CIH virus can be prevented by using anti-virus software that can really be embedded in the bottom of the operating system and has efficient real-time anti-virus function, such as KILL series anti-virus products.

For the hard disk that has been destroyed by CIH, KILL 98 can do the following:

1, the first logical disk, usually C: disk, cannot be completely recovered, but if you have made an emergency disk with KILL 98, you can use the records of the main boot area and partition table saved in the KILL 98 emergency disk to recover the hard disk and retrieve most files. The specific process is as follows: put the KILL 98 first aid disk into the A disk of the computer whose hard disk is damaged, start it with the KILL 98 first aid disk, and enter the main menu of the KILL 98 first aid disk:

(1) Check and repair the boot zone virus.

(2) Compare and repair the boot area.

(3) Exit the repair. Select 2 and confirm.

If you haven't made a first-aid disk before, install KILL 98 for Windows 95/98 on another computer with the same configuration (not infected by virus) and upgrade to the latest version to make a kill 98 first-aid disk. You can also recover completely according to the above method.

2. Other logical disks, as long as they are not FAT32, can be recovered by disk tools such as NDD or KILL 98 emergency disk, but users need to have enough knowledge of the physical structure of the hard disk.

3. The logical disk of FAT32 partition needs to be restored manually by professionals who have a deep understanding of FAT32 structure with tools such as Debug.

Repair the damaged motherboard

For the motherboard damaged by CIH virus, you can do the following:

1. If it is a manufacturer's brand motherboard that can provide good service, please contact the manufacturer.

2. Find a motherboard of the same model (the manufacturer and version of BIOS must be exactly the same), download the upgrade file provided by the motherboard manufacturer, take out the bad BIOS, start your computer with a new BIOS chip, switch back to the bad BIOS chip after charging, and write from disk A. ..

Special attention: this method is very dangerous because of live operation, and the whole hardware may be destroyed after operation. Please be careful!

3. Some motherboard upgrade programs will detect the BIOS version number when writing. If not, it cannot be rewritten. In this case, the BIOS chip of the computer must be replaced. You can contact your hardware buyer or motherboard agent in China.