CIH Chernobyl Virus: History and Aftermath of the 1999 Attack

On April 26, 1999, PC users running Windows 9x experienced mass data destruction and BIOS damage due to the resident CIH virus.

Origin Story

The malicious program was created by Chen Ing-hau, a student at Datun University. He developed the virus to demonstrate the ineffectiveness of antivirus software at the time.

The virus initially spread from university computers before reaching Usenet newsgroups. In July 1998, it infected the Ritual Entertainment server, from which the beta version of the game SiN was distributed worldwide. By March 1999, IBM had shipped thousands of infected computers to clients.

Key Characteristics

Unlike file-infesting viruses that increase executable file sizes, CIH was only 1 KB in size. It placed its payload in unused code sections, preserving the original file size and evading detection. This characteristic earned it the nickname Spacefiller.

Damage Mechanism:

• Zeroing out the first 1024 KB of the disk to destroy the boot sector and partition table
• Erasing FlashBIOS content if write access to the motherboard's flash memory was possible
• Bypassing standard write protection for boot sectors through direct disk access

Activation Date

The first activation of CIH occurred on April 26, 1998. The trigger was scheduled exactly one year after the release of the first version. This coincided with the 13th anniversary of the Chernobyl disaster, giving the virus its most famous name.

Consequences and Reaction

Chen Ing-hau and his classmate Wen Shih-Hao later published an utility to remove the virus, but the damage had already been done. Estimates suggest total damages amounted to approximately $1 billion USD. Affected systems ranged from half a million to tens of millions of computers worldwide.

The developer issued public apologies. However, no complaints were filed with the Taiwan police by victims, allowing the creator of CIH to avoid severe punishment.