ViRobot

Security Info

  • Security Center
  • Security Dictionary
  • Security Service
  • Free Download!!

Threats DB

Win95.CIH.1042

Aliases  Win95/CIH.1042(Anlab)
Typical Symptoms  Destroys flash memory,Destroys HDD
Discovered  [korea] 2000-07-22
 [Foreign] 2000-07-22
Type  Virus ActiveField  Windows 9X
Destory/Distribution
Origin  others Encryption  NO
Location  File Memory residence  YES
Scan engine needed
2000-09-01 [Able to detect & repair]
  • Free trial download
Description
Win95.CIH.1042 is one of the variants of Win95.CIH virus and its trigger date is on the 4th of every month.

Upon execution, it resides in the memory and infects all ".exe" files in Windows 95/98. It destroys the flash memory and puts useless data in the fore part of the hard disk on the 4th of every month. However, this virus cannot be activated on Windows NT system due to its memory-residing feature.  



Win95.CIH.1042 is one of the variants of Win95.CIH virus.

Upon execution, it resides in the memory and infects all ".exe" files in Windows 95/98. It destroys the flash memory and place random data in the front section of the hard disk on the 4th of every month. However, this virus cannot be activated on Windows NT system due to its memory-residing feature.

It has the following string in its code:

Go away fuck up V1.0 by NetCracker1


* Other variants and their trigger date *

This virus has many variants with different trigger date.
However, the payload is the same as the original virus (with the exception of Win95.CIH.D, which does not have any harmful payload).

Win95.CIH                    On 26th April
Win95.CIH.B (ver. 1.3)  On 26th April
Win95.CIH.C (ver. 1.4)  On 26th of every month
Win95.CIH.D (ver. TNT) No destructive payload
Win95.CIH.E (ver.1.8)   On 18th of every month (Originated from Korea)
Win95.CIH.1042            On 4th of every month


Removal Instructions
For ViRobot users

Download the latest definitions of 1 Sept 2000 or above to repair the virus.

* Note : Please configure ViRobot to scan all files.
         If the virus have already corrupt your hard disk, please contact us for recovering your data.


List
Copyright 2008 @ HAURI Inc. All rights reserved. SiteMap