April 26 virus keeps date with desktops

While close to 10,000 desktop computers were infected throughout India, the worst hit were large private enterprises where close to 35 systems were infected in some cases. Insiders said Larsen & Tourbo, Cox & Kings and Lintas were some of the leading companies which were affected by the virus.Anti-virus firms, which were inundated with telephone calls throughout the day, were reluctant to reveal which companies had been infected, mostly because of the sensitive nature of the information nearly 50 per cent of cases involved companies which had diversified businesses with over Rs 100 crore turnover.

“Of the 100 companies we received calls from 40 per cent were large corporations,” said Fayaz Ahmed of N&N Systems, a leading anti-virus software company. “It is our policy not to reveal company names,” he added.MicroWorld System, exclusive distributor for F-Prot and F-Secure anti-virus packages, said most companies were embarrassed to reveal their names and were wary of the damage it could do to their image. A big software firm was among those which were affected badly.

“Most companies dismissed our warnings and mailers as marketing gimmicks. We had even posted a free download patch for the virus at our site (microworldsystems.com). In spite of this, companies did not take adequate measures to protect their systems,” said Bhuvana Kumar, director of Microworld. Kumar estimates, on the conservative side, at least 500 companies would have been affected throughout India by the virus causing monetary loss of lakhs of rupees.

The virus also known as W32.CIH virus or Win95.CIH virus infects only Windows 95 and Windows 98 systems. It triggers on April 26 and overwrites or deletes all information on the hard drive in the systems it infects. It also has the ability to overwrite flash BIOS chipsets (basic instruction set of the PC) on 486, Pentium and Pentium II systems.

The virus was discovered in Taiwan on June 1998 and consequently, no cases of infections were reported in April last year. Peter Theobald of IT Secure (distributor for Dr Solomon’s Anti-Virus) warned certain strains of the virus (version 1.4) activate on the 26th of any month.

The virus could have spread through the internet, through floppies or by downloading infected Windows executable files from another machine. In this case, the virus was also unknowingly distributed through compact discs (CDs) at two events the India Engineering Trade Fair (IETF) and the CN+I.At the IETF, which was held at Delhi between February 12 and February 17, 1999, complimentary CDs were distributed at the Tata pavilion which were later found to be infected. Following this both the company which developed the CD, Chidgani Creations, and Tata Enterprises, for which it was developed, issued advertisements in newspapers warning recipients not to use the CD.

Similarly at the CN+I event held in Mumbai in December 1998 it was later discovered that the CD containing the presentations made at the event were infected. The organisers immediately issued letters to all the recipients warning them not to use the CD and also replaced it with an uninfected CD. Despite these measures, it is possible that some of these CDs also helped in spreading the virus.

On the positive side servers, which store lots more important data as opposed to desktops, were not affected. Senior VSNL official said none of their services were affected because all their servers were on the Unix operating system. Satish Naralkar of NSE said the exchange had already posted anti-virus software on its server and only those PCs which did not download it from the server were infected. "Only around three to four PCs were infected," he said.

Top