On April 26, 1998, it was a birthday of CIH virus. This virus was first found in Taiwan, which was prepared by 24-year-old Chen Yuxi Chen Ing-Halu, because the first letter is C, I, H, So this may be the origin of a computer virus name. As Pandora's box is opened, since then, this virus is like a ghost. On April 26th, a year, China's more than 300,000 computer users have experienced a heart-fashioned dream: when from the beginning of the spring When you walk into the office to open your computer, there is no display. Only death is silent. Single is calculated as a unit of economic losses. From then on, Chinese computer users understand: viruses are very powerful, viruses Around it. Destructive: CIH is one of the most sophisticated viruses found so far, which can be written to the hard disk from the hard disk main guidance zone when poisoning is ripe, and the hard disk data is written into the hard disk. Until the hard disk data is all destroyed. Under the worst case, all data (including all logical disk data) is destroyed. In addition, the BIOS information in the Flash ROM on some motherboards will be cleared. CiH has 3 versions, version 1.2 (most popular) on April 26, version 1.3 episode June 26, 1.4 version is on the 26th of the month (most powerful). In addition, recent CiH's variant seizes each year, commonly known as "Christmas CIH", is said to be more concealed, more destructive than CIH.
Solution: Although there are many software in CIH, such as real-time monitoring functions of major anti-virus software, it is inevitable to zeal. Principle: Program according to the two weaknesses of the virus: 1, only on the specific date 2, only after entering Windows, I can set a small program in AutoExec.bat, remind the user to change the date before entering Windows. Detailed steps: (1) Open or create autoexec.bat with Notepad, enter the following: Rem ***** CiH & 25CIH *****
This behavior comment is not executed Type Nul> C: /Today.is
Create a 0-byte empty temporary file Todoy.iscls clear screen display Dir C: /Today.is | Find "-26-"
Find whether the boot time is 26 if not errorlevel 1 Goto Cih
If there is no error, it is performed on the 26th: CIH
Subprogram goto nocih
Otherwise, it is not 26 days to: Nocih subroutine: CIH: is the logo of the subroutine, CiH is a subroutine name Echo Today! Please Change Clock To 27th in the cmos!
It is on the 26th to show English "Today is CIH day, please change the date in CMOS" Pause pause program running, and display English "press any key countinue" Del C: / Today. IS> NUL
Delete Today.is (NUL is a prompt not to display the delete process) Restart.com
Execute Restart.com, this file can be extracted into the EBD.CAB in the Win98 boot disk, put it in C: / below: Nocih
Not on the 26th, the subroutine is performed. The following prevention of Christmas Cih is no longer illustrated above CLSDIR C: / Today.is | Find "12-25-" if Not Errorlevel 1 GOTO 25VIRGOTO NOVIR: 25Virecho Today Is Cih Day ! Please Change Clock To 27th In The CMOS! Pausedel C: / Today.is> Nulrest.com:novirdel C: / Today.IS> Nulrem ***** CiH & 25CIH ***** CLS Used: When you are on month When you open your computer on or on December 25, the screen will appear in English Tips "Today's IS CIH Day!" Is as shown: Press any key to restart your computer, then press the Delete key to enter CMOS , Change the date to 27 days, don't forget to change the date back to the normal date the next day.
