Parent class: VirWare
Viruses and worms are malicious programs that self-replicate on computers or via computer networks without the user being aware; each subsequent copy of such malicious programs is also able to self-replicate. Malicious programs which spread via networks or infect remote machines when commanded to do so by the “owner” (e.g. Backdoors) or programs that create multiple copies that are unable to self-replicate are not part of the Viruses and Worms subclass. The main characteristic used to determine whether or not a program is classified as a separate behaviour within the Viruses and Worms subclass is how the program propagates (i.e. how the malicious program spreads copies of itself via local or network resources.) Most known worms are spread as files sent as email attachments, via a link to a web or FTP resource, via a link sent in an ICQ or IRC message, via P2P file sharing networks etc. Some worms spread as network packets; these directly penetrate the computer memory, and the worm code is then activated. Worms use the following techniques to penetrate remote computers and launch copies of themselves: social engineering (for example, an email message suggesting the user opens an attached file), exploiting network configuration errors (such as copying to a fully accessible disk), and exploiting loopholes in operating system and application security. Viruses can be divided in accordance with the method used to infect a computer:- file viruses
- boot sector viruses
- macro viruses
- script viruses
Class: Virus
Viruses replicate on the resources of the local machine. Unlike worms, viruses do not use network services to propagate or penetrate other computers. A copy of a virus will reach remote computers only if the infected object is, for some reason unrelated to the virus function, activated on another computer. For example: when infecting accessible disks, a virus penetrates a file located on a network resource a virus copies itself to a removable storage device or infects a file on a removable device a user sends an email with an infected attachment.Read more
Platform: Win9x
No platform descriptionDescription
Technical Details
This is a Windows95/98 specific parasitic virus infecting Windows PE files (Portable Executable), which is about 1Kbyte in length. Also known as Chernobyl. This virus was found "in-the-wild" in Taiwan in June 1998, being released by its virus author who was studying at a local university at the time. The virus (accidentally?) was posted at a local Internet conference that released the virus out of Taiwan. Within a week, the virus was found in Austria, Australia, Israel, United Kingdom, and was also reported from several other countries (Switzerland, Sweden, USA, Russia, Chile, etc.).
In about a month, the infected files were accidentally put on several Web sites in the USA (game software distribution sites) that caused a global virus epidemic. In about a year after the virus' appearance on March 26th 1999, the "time-bomb" in virus code caused a computer catastrophe when about half of a million computers were damaged because of virus infection: all of them lost data on the hard drive, and many of them also had the motherboard BIOS destroyed (plus hard-drive data damaged). This incident was significant as there had been no such global and terrible computer incidents known to date at this time.
Because the virus "bomb" day falls on the day of the Chernobyl catastrophe that shocked the world on 26th April 1986, the virus, already known as "CIH" got its second name - "Chernobyl".
Despite this, the virus author did not link his "bomb" with Chernobyl (maybe he had never even heard of Chernobyl). It seems the "bomb" day was selected for another reason. The first virus version (that fortunately hasn't left Taiwan) was released on April 26 1998, so the virus celebrated its "birthday" on April 26 1999.
How the virus works
The virus installs itself into the Windows memory, hooks file access calls and infects EXE files that are opened. Depending on the system date (see below), the virus runs its trigger routine. The virus has bugs and in some cases, halts the computer when an infected application is run.
The virus' trigger routine operates with Flash BIOS ports and tries to overwrite Flash memory with "garbage". This is possible only if the motherboard and chipset allow for the writing to Flash memory. Usually writing to Flash memory can be disabled by a DIP switch, however, this depends on the motherboard design. Unfortunately, there are modern motherboards that cannot be protected by a DIP switch - also, some of them do not pay attention to the switch position and this protection has no effect at all. Some other motherboard designs provide written protection that can be disabled/overridden by software.
The trigger routine then overwrites data on all installed hard drives. The virus uses direct disk write calls to achieve this and bypasses standard BIOS virus protection while overwriting the MBR and boot sectors.
There are three "original" virus versions known, which are very closely related and only differ in a few parts of their code. They have different lengths, texts inside the virus code and trigger date:
Length Text Trigger date Found In-The-Wild 1003 CIH 1.2 TTIT on April 26th YES 1010 CIH 1.3 TTIT on April 26th NO 1019 CIH 1.4 TATUNG on 26th of any month YES - many reports
Technical details
While infecting a file, the virus looks for "caves" in the file body. These caves are a result of the PE file structure: all file sections are aligned by a value that is defined in the PE file header, and there are unused blocks of file data between the end of the previous section and the next one. The virus looks for these caves and writes its code into them. The virus then increases the size of sections by the necessary values. As a result, the file length is not increased while infecting.
If there is a cave of enough size, the virus saves its code in one section. Otherwise, it splits its code into several parts and saves them to the end of several sections. As a result, the virus code may be found as set of pieces, not as a single block in infected files.
The virus also looks for a cave in the PE header. If there is an unused block not less than 184 bytes in length, the virus writes its startup routine to there. The virus then patches the entry address in the PE header with a value that points to the startup routine placed in the header. This is the same trick that was used in the "Win95.Murkry" virus: address of program entry points not to some file section, but to the file header - out of a loadable file data. Despite this, infected programs are run with no problems - Windows does not pay any attention to such "strange" files, loads the file header into the memory, then file sections, and then passes control to the virus startup routine in the PE header.
When the virus startup routine takes control, it allocates a block of memory by using the PageAllocate VMM call, copies itself to there, locates other blocks of virus code and also copies them to the allocated block of memory. The virus then hooks the system IFS API and returns control to the host program.
The most interesting thing in this part of the virus code is that the virus uses quite complex tricks to jump from Ring3 to Ring0: when the virus jumps to newly allocated memory, its code is then executed as Ring0 routine, and the virus is able to hook the file system calls (it is not possible in Ring3, where all users applications are run).
The IFS API virus handler intercepts only one function - file opening. When PE .EXE files are opened, the virus infects them, provided there are caves of enough size. After infection, the virus checks the file date and calls the trigger routine (see above).
While running its trigger routine, the virus uses direct access to Flash BIOS ports and VxD direct disk access calls (IOS_SendCommand).
Other known virus versions
The original virus author released not only virus code in affected EXE files to the wild, but a virus source (assembler) code as well. These source code were patched, recompiled, and new virus versions were found because of this. Most of these versions are buggy and not able to replicate, but others can do. All of them are very closed to original viruses, but there are a few differences. The main difference is that the "bomb" date has changed, and new variants of the virus either erase data and Flash BIOS on other days, or this routine is never called.
There are also "original" versions of the virus patched so that they have other "bomb" days. The reason for this is actually humorous: the virus checks the trigger date by comparing the current day and month number with two constants (two bytes). By patching these constants, it is possible to select any day the virus will destroy computers.
Read more
Find out the statistics of the vulnerabilities spreading in your region on statistics.securelist.com