Spacer Sidebar Directory Map

The Training Book, the handbook for trainers

Training Express computer learning guides

 

ITrain - International Association of Computer Trainers Serious Virus Threat
Details of common computer virus
ITINFO Sponsor
FastTips Newsletters

Want to publish technical newsletters for your clients and coworkers? Don't have the time to research & write the articles, let alone do the desktop publishing?

FastTips newsletters are hard-hitting, to-the-point newsletters filled with useful computer tips & tricks. Each one is pre-printed with your name, address, and phone number. They'll keep your clients begging for more.

Click for FastTips Newsletters for YOUR clients

Internet Poll
Have you attended a seminar via e-learning?
yes
no

poll archive

W32.CIH Spacefiller Virus Details
by Dave Murphy
ISSN 1535-3613

Dave Murphy, DGL President & ITrain founder The following details are excerpted from the Network Associates virus information database.

The W32.CIH.Spacefiller virus originated in Taiwan in early June 1998 and within one week was worldwide. The virus infects Windows 95 and 98 executable files and will quickly infect all the files of this type it can find.

When an infected file is run, the virus becomes memory resident. It will then infect other files when they are copied or opened. Infected files will be the same size as the original file because of the unique infection techniques used, so this make the virus difficult to detect. The virus will first look for empty spaces in the file, then it will break itself up into small fragments and hide in the file. However the virus has some bugs, and in some cases can crash your computer, when infected applications are run.

The virus can overwrite or delete information on the hard drive by using direct disk-writes calls, bypassing standard BIOS virus protection, while overwriting the MBR (Master Boot Record) and boot sectors. It can also overwrite certain flash BIOS chipsets on some machines from a 486 through a Pentium II, which have flash BIOS.

Some computers have a jumper on the motherboard, which acts as hardware write protection. Some machines also have a DIP switch, which allows the flashing BIOS to be disabled. There are some newer computers that cannot be protected by the switch and therefore are vulnerable to the virus. If payload executes it will leave the PC inoperable unless the BIOS is restored or replaced.

McAfee Labs now has a cleaner for this virus in VirusScan 3.2.0 engines and above. You will need the 3109 or greater datfiles (antivirus data files) in order to detect and clean this virus.

McAfee's VirusScan is our recommended anti-virus program.

McAfee's website is www.mcafee.com.

Subscribe to ITINFO.
Receive computing and Internet news & tips
by subscribing to the ITINFO information service.
Type your Internet email address in the form, and click "Subscribe."
Email Address:

Damar Group, Ltd. helps business use technology.

ITINFO is again accepting sponsors. Sponsor messages are included in ITINFO's email newsletter and are permanently posted to DGL's website and online reference areas.

ITINFO is an electronic publication of Damar Group, Ltd., publisher of Training Express computer learning guides. Comments and submissions to info@dgl.com.

Previous issues are on our website at http://dgl.com/dglinfo/.

updated December 15, 1998
http://dgl.com/dglinfo/1998/dg981215.html

Return to DGL homepage
Copyright © 1998, Damar Group, Ltd., All Rights Reserved