Editing CIH (computer virus) (section)

{{Short description|Windows 9x computer virus}}
{{For|a similar signature in FAT OEM labels|FAT IHC OEM label}}
{{Infobox computer virus
 |  | image=CIH.png
 | caption=Antivirus intercept message on a Windows 95 system}}
'''CIH''', also known as '''Chernobyl''' or '''Spacefiller''', is a [[Windows 9x|Microsoft Windows 9x]] [[computer virus]] that first emerged in 1998. Its payload is highly destructive to vulnerable systems, overwriting critical information on infected system drives and, in some cases, destroying the system [[BIOS]]. The virus was created by Chen Ing-hau (陳盈豪, [[pinyin]]: ''Chén Yíngháo''), a student at [[Tatung University]] in [[Taiwan]].<ref name=ithome>{{cite web | title=從CIH「重裝駭客」變身「除錯超人」 | website=iThome online | date=2006-08-25 | url=http://www.ithome.com.tw/itadm/article.php?c=38975 | archive-url=https://web.archive.org/web/20130417062110/http://www.ithome.com.tw/itadm/article.php?c=38975 | archive-date=2013-04-17 | url-status=dead | language=zh}}</ref> It was believed to have infected sixty million computers internationally, resulting in an estimated {{currency|1 billion|TWD|passthrough=yes}} ({{currency|{{To USD|1000000000|TWN}}|USD}}) in commercial damages.<ref name=ithome/>

Chen claimed to have written the virus as a challenge against bold claims of antiviral efficiency by [[antivirus software]] developers.<ref name=parenting>{{cite web | title=從駭電腦到愛旅行─昔日網路小子陳盈豪 - 親子天下雜誌8期 - 陳盈豪,網路世界,宅男,網路沉迷 | website=parenting.com.tw | date=2013-06-07 | url=http://www.parenting.com.tw/article/article.action?id=5020407 | archive-url=https://web.archive.org/web/20130607045905/http://www.parenting.com.tw/article/article.action?id=5020407 | archive-date=2013-06-07 | url-status=dead | language=zh}}</ref> Chen stated that after classmates at Tatung University spread the virus, he apologized to the school and made an antivirus program available for public download. Weng Shi-hao (翁世豪), a student at [[Tamkang University]], co-authored with the antivirus program.<ref name=parenting/> Prosecutors in Taiwan could not charge Chen at the time because [[Antragsdelikt|no victims]] came forward with a lawsuit.<ref>{{cite web | title=打擊駭客，不再無法可施 - 安全常識 - 法務部行政執行署嘉義分署 | publisher=行政執行署嘉義行政執行處 | date=2005-12-10 | url=http://www.cyy.moj.gov.tw/ct.asp?xItem=24238&ctNode=13535 | archive-url=https://web.archive.org/web/20131029210313/http://www.cyy.moj.gov.tw/ct.asp?xItem=24238&ctNode=13535 | archive-date=2013-10-29 | url-status=unfit | language=zh }}</ref> Nevertheless, these events led to new [[Cybercrime|computer crime]] legislation in Taiwan.<ref name=parenting/>

The name "Chernobyl Virus" was coined sometime after the virus was already well known as CIH and refers to the complete coincidence of the payload trigger date in some variants of the virus (actually the virus creation date in 1998, to trigger exactly a year later) and the [[Chernobyl disaster]], which happened in the [[Soviet Union]] on April 26, 1986.<ref name="auto">{{Cite web |title=What is the Chernobyl Virus? (with pictures) |url=http://www.easytechjunkie.com/what-is-the-chernobyl-virus.htm |access-date=2023-02-16 |website=Easy Tech Junkie |language=en-US}}</ref>

The name "Spacefiller" was introduced because most viruses write their code to the end of the infected file, with infected files being detectable because their file size increases. In contrast, CIH looks for gaps in the existing program code, where it then writes its code, preventing an increase in file size; in that way, the virus avoids detection.<ref name="auto"/>