CIH Virus That Killed Computers

There is a date that computer owners once learned to fear: 26 April. In the late 1990s, plenty of people went to bed on 25 April with a perfectly healthy computer on the desk. It had worked that evening. It had worked all year. Nothing had ever seemed wrong with it. Then morning came, they pressed the power button, and the machine gave them nothing. No starting sound of hope. No friendly screen. Just a black, silent box that behaved as if it had never known how to be a computer at all.

Nothing had been stolen in the night. Nobody had dropped the machine or spilled tea on it. The damage had been sitting inside it for weeks or months, patient as a seed in winter, waiting for one square on the calendar. That sleeping destroyer was the CIH virus, better known around the world by a darker nickname: the Chernobyl virus. To this day, it is remembered as the virus that did not just hurt files. It could kill the computer itself.

What the CIH virus is

CIH first appeared in 1998. It was written by Chen Ing-hau, a student in Taiwan, and the three letters of its name are simply his own initials. That small detail makes the story stranger, because this was not a giant criminal gang or a secret government laboratory. One student’s program went on to frighten half the planet.

The CIH virus was built for the home computers of its time: machines running Windows 95, Windows 98 and Windows ME. It infected program files, the files with names ending in .exe, which are the files a computer runs when you open a game, a tool or any other application.

What made CIH so clever, and so hard to catch, was the way it hid. Every program file has small empty gaps inside it, a bit like the blank spaces between chapters in a book. CIH split itself into little pieces and tucked those pieces into the empty gaps. Because it used space that was already there, an infected file did not grow bigger. A program that was checked by size looked exactly as it should. The wolf was not just inside the house; it had learned to stand perfectly still behind the furniture.

What the Chernobyl virus does on its day

For most of the year, CIH did very little that an ordinary user could see. It copied itself from file to file and waited. But it carried a date inside it, and the most famous version of the virus was set to wake on 26 April. That date is the anniversary of the Chernobyl nuclear disaster of 1986, and it is the reason the virus earned its nickname.

When the date arrived, CIH attacked in two ways at the same time.

The first attack struck the hard disk. A hard disk keeps a kind of map at its very beginning, a guide that tells the computer where every file lives. CIH overwrote the beginning of the disk with garbage. Imagine someone tearing the index out of a huge library and replacing it with scribbles. The books are still on the shelves, but nobody can find anything any more. For the owner, the effect was simple and brutal: their files, work and memories were effectively gone.

The second attack was the one that truly made history. On many machines, CIH also tried to overwrite the BIOS. The BIOS is a tiny built-in starter program kept on a chip on the motherboard, the main board inside the computer. Its job happens in the first seconds after you press the power button, before Windows even begins. It is the machine’s spark of life. When CIH managed to overwrite it, the computer could not start at all. No repair disc could help, because the machine could not even reach the point of reading a disc. The chip had to be replaced, or taken to specialists who could rewrite it with special equipment.

This is why old-timers still speak about CIH with respect. Most viruses damage your things. CIH reached one level deeper and damaged the machine’s ability to wake up.

How the CIH virus spreads, and how it reaches ordinary people

CIH travelled by the ordinary roads of its era. It spread inside downloaded software, in pirated programs passed from person to person, in infected files shared on floppy disks and CDs, and through the young, fast-growing web of the late 1990s.

Notice the pattern, because it has never really changed. The virus rarely smashed its way in. It was invited. Somebody wanted a free game, a free tool, a program without paying, and the file they picked up had a passenger hiding in its empty spaces. One person installed it, the virus quietly infected more programs on that machine, and any file shared onward carried the infection to the next desk, the next home, the next office.

A thing like CIH can still reach an ordinary person today by the same front door: software from places that cannot be trusted. The package looks generous. The price is zero. The real cost is hidden inside, and sometimes, like CIH, it does not present the bill until long after you have forgotten where the file even came from. Dates and delays make traps like this worse, because by the time the damage happens, nobody remembers the download that caused it.

The morning of 26 April 1999

The world did not fully understand CIH until its calendar page turned. On 26 April 1999, the virus struck across Asia and beyond, all on the same morning, like an alarm clock ringing in thousands of buildings at once.

Reports from that time spoke of damage on a huge scale. In South Korea alone, estimates ranged from hundreds of thousands to millions of computers affected. Banks, universities and businesses across several countries found machines that would not start and disks whose contents had been destroyed. The total damage was estimated at the time to run into hundreds of millions of dollars.

Think about what that morning felt like in an office or a university computer room. Row after row of screens that simply never lit up. It was not one broken computer; it was all of them, together, on the same day, for the same hidden reason. That shared silence is what burned 26 April into the memory of a whole generation of computer users.

What happened to the man who wrote it

The story has a quiet and surprising ending. Chen Ing-hau was detained and questioned in Taiwan in 2000, after a computer at a local university was infected. But, as reported at the time, Taiwan did not then have a law that clearly covered what he had done, and he was not prosecuted for the original release of the virus. The program that had caused so much fear travelled the whole world, yet the legal system of its home country had no neat box to put its creator in.

How to protect yourself from a virus like the Chernobyl virus

The good news is that the lessons CIH taught are simple, and they still protect people today.

Download software only from trusted sources. This is the single biggest lesson of the CIH virus. Pirated programs and “free” versions of paid software from strange websites were CIH’s favourite road into homes, and untrusted downloads remain the oldest trap in computing. If a program normally costs money and a random site offers it free, ask what the catch is. There usually is one.

Keep a good antivirus switched on and updated. A modern antivirus recognises known viruses and watches programs for suspicious behaviour, and it would spot a classic like CIH easily today. The protection only works if it is actually running and allowed to update, so do not ignore it or turn it off when it becomes annoying.

Be careful with files other people hand you. Disks, USB sticks and files sent by friends can all carry infections, even when the friend means no harm at all. CIH spread exactly this way, passed along by people who had no idea their files were infected. Scan anything that arrives from outside before you open or install it.

Keep backups of the files that matter. CIH’s first attack destroyed the map of the hard disk, which shows how fast ordinary files can become unreachable. Keep copies of your important photos, documents and work somewhere separate, such as an external drive that you unplug when you are not using it, or a trusted cloud service. With a separate copy kept safe, even a dead machine is only a bad day, not a lost life of files.

Do not ignore strange behaviour. CIH hid well, but many infections give small warnings first: programs becoming slow, files behaving oddly, a computer doing things nobody asked it to do. Running a full antivirus scan at the first sign of trouble is always cheaper than waiting.

I keep coming back to one thought in this story: the most frightening viruses are not always the loud ones, because a quiet program and a single date were enough to leave whole rooms of computers dead.

Common questions

Why is CIH called the Chernobyl virus?

The most famous version of CIH was set to strike on 26 April, which is the anniversary of the Chernobyl nuclear disaster in 1986. Because of that date, people gave the virus the nickname “Chernobyl.” Its real name, CIH, comes from the initials of its creator, Chen Ing-hau.

Can the CIH virus still infect computers today?

CIH was built for Windows 95, 98 and ME, so it belongs to an older generation of computers and cannot do its old damage on modern systems in the same way. Its real importance today is the lesson it teaches. Untrusted downloads and unprotected machines are still dangerous, even though the viruses have changed their faces.

Why could CIH stop a computer from starting at all?

As well as overwriting the start of the hard disk, CIH tried to overwrite the BIOS, the tiny starter program on a chip on the motherboard. The BIOS is what wakes the computer up in the first seconds after the power button is pressed. If that program was destroyed, the machine could not begin starting, and the chip had to be replaced or rewritten by specialists.

How did CIH hide inside files without being noticed?

Program files contain small empty spaces, and CIH split itself into pieces that fitted into those gaps. Because it used space that already existed inside the file, the file did not become any larger after infection. Anyone checking file sizes, a common quick check at the time, would see nothing suspicious.

What is the biggest lesson ordinary people can learn from CIH?

The virus mostly travelled inside pirated software and files from untrusted places, so the biggest lesson is to only install programs from sources you trust. Keeping an updated antivirus and a separate backup of important files adds two more layers of safety. Together, those three habits stop most threats of this kind before they can hurt you.

Sources

• Wikipedia — CIH (computer virus): https://en.wikipedia.org/wiki/CIH_(computer_virus)