Computer users have been urged to be on the alert for a virus attack tomorrow, the anniversary of the 1986 Chernobyl nuclear disaster in Ukraine.
The W95.CIH (Chernobyl) virus is set to blow tomorrow.
Liu Xu, a senior anti-virus expert, said yesterday: "We advise computer users to check their systems with an anti-virus program and back up their data in advance, as the highly destructive CIH infection is ready to wreak fresh havoc tomorrow."
Liu's Beijing Rising Computer Sci-Tech Company was the first on the Chinese mainland to detect and develop an antidote to eradicate the virus in 1998. He said CIH can overwrite the hard disk and Flash BIOS (basic input/output system) of an infected computer.
It thus causes complete loss of data and possibly renders a computer unbootable, he said.
The CIH virus is still a threat, nearly four years after it was discovered in June 1998 in Taiwan.
Part of the virus name comes from the initials of program writer Chen Ing-hau, according to Liu.
CIH has different strains, forming a family of computer viruses that infect Windows 95/98 executable programs. The most common one, Version 1.2, has a payload that will trigger on April 26. The others are triggered either on June 26 or the 26th day of any month, Liu said.
On April 26 last year, Beijing alone saw the infection affect 6,000 computers. The virus caused more than US$1 billion of damage worldwide in 2000, according to earlier newspaper reports.
Those who are vulnerable to the virus include computer users who download programs online, and those who use no antivirus software, warned Liu and experts belonging to the United States security-software maker Symantec.
To enhance computer users' awareness of the virus, the Rising company has teamed up with the Internet portal Tom.com to spread CIH information and solutions, according to Liu.
The Legend Computer Systems Company - China's largest PC maker - yesterday said it is offering a discounted service for the repair of CIH-damaged Legend computers over the coming weeks.
Experts suggest that computer users update their antivirus software, thoroughly scan and clean their computer systems, and back up data on their hard disks.
Symantec's CIH-removal tool can detect and remove known strains of the W95.CIH virus from a computer's memory. This will allow the Norton antivirus software to remove the infection from both the files and memory of the infected computer, according to Symantec experts.
The Beijing Rising company has put its CIH removal and recovery tool on its website www.rising.com.cn, Liu said.
The enhanced version of its Anti-Virus Software 2002 lets a computer user back up the hard disk in just minutes.
It also can automatically detect and prevent a variant of another notorious program, called Worm.Klez. This sends itself in e-mail messages with infected documents attached and even carries the CIH virus to other computers, according to Liu.
(China Daily April 25, 2002)
