Welcome to the Virus Encyclopedia of Panda Security.
|Alias:||CIH, Chernobyl, Win95/CIH.1049|
|Effects: ||It deletes the content of the hard disk, preventing the computer from starting.
|First detected on:||May 2, 2002|
|Detection updated on:||March 17, 2006|
|Yes, using TruPrevent Technologies
CIH.1049 is a resident virus that, in order to spread, uses several means of transmission, but it does not use a specific method.
This virus is extremely dangerous, as on August 2 it deletes the content of the hard disk and the content of the BIOS.
It also infects files with an EXE extension.
After CIH.1049 has infected a computer, various symptoms can be noticed:
- When the computer is started up, the following message is displayed:
DISK BOOT FAILURE, INSERT SYSTEM DISK AND PRESS ENTER
This message indicates that the computer cannot be started. The reason for this is that CIH.1049 has deleted important information from the hard disk.
- If the computer is booted from another disk and then the C:/ drive is accessed, the following warning is displayed:
INVALID DRIVE SPECIFICATION
This means that the system does not recognize the hard disk because it is completely blank.