CIH: the virus that could stop a computer from starting

The story

CIH was written in 1998 by Chen Ing-hau, a university student in Taiwan, and named after his initials. It infected programs on computers running Windows 95 and 98, and it spread through shared files, downloads and even software sold on disks.

The virus stayed quiet until its trigger date. On April 26, 1999, the most widespread version woke up on infected computers and overwrote the start of the hard drive, wiping the information the computer needed to find files. On some machines it also overwrote the BIOS chip on the motherboard, the small piece of software a computer runs first when it is switched on. Those computers would not start at all until the chip or the whole board was replaced.

The date matched the anniversary of the Chernobyl nuclear disaster, which is why it became known as the Chernobyl virus. Hundreds of thousands of computers were damaged worldwide.

Why it mattered

CIH showed that malware could cause physical damage, leaving computers that would not start again until parts were replaced. Because some copies came on software sold on disks, it also showed that infected files can arrive from sources people trust. Recovery meant spare equipment as well as backups.

The lesson today

CIH was an early wiper: malware built to destroy data. Wipers are still used today. The only full recovery from one is a recent backup kept somewhere the malware cannot reach, and a tested way to restore it.