X-Priority: 2 (High) Date: Fri, 24 Jul 1998 15:25:45 -0400 To: csr@smash.gatech.edu, snag@gt.ed.net, information-technology@oit.gatech.edu From: Ray Spalding Subject: GT/IRSC ALERT: Win32/CIH Virus ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ INFORMATION TECHNOLOGY SECURITY ALERT Georgia Institute of Technology Information Resources Security Coordinator Alert number 98-04 (1998-07-24) ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ AFFECTED: Microsoft Windows 95 & 98 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ACTION REQUIRED: YES Install or update virus protection ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ DETAILS: The Win32/CIH viruses contain a very dangerous payload, which triggers on the 26th of any month. On this date, they attempt to overwrite the flash-BIOS. If the flash-BIOS is write-enabled (and this is the case in most modern computers with a flash-BIOS) this renders the machine unusable because it will no longer boot. At the same time, they also overwrite the hard disk with garbage. Dr Solomon's Anti-Virus version 7.8.6 is effective against this virus and is available free of charge to all Georgia Tech faculty, staff, and students at: If you have an earlier version of Dr. Solomon's, you may alternatively wish to download and install a temporary "extra driver". For further information, see: If you have another brand of virus protection, visit the vendor's web site to determine protective action. ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Reminder: The Georgia Tech Information Resources Security home page is at