@theyoshimarioguy it's the screen recorder. There is one virtual mouse used in the VM and the actual mouse on my desktop. The screen recorder records both.
The size didn't change because CIH uses "multiple cavity infection"-method (see wikipedia). In layman's terms, it uses empty pre-existent spaces in files.
@KaxFin I know what multiple cavity infection is and if there isn't enough slack space in the file, then IT WON'T INFECT IT! The CIH virus places a marker on every file it reads and if the file isn't able to be infected, it places a marker in the PE header stating so. I write only in Assembly Language so I control the size of each part of my executable and I chose not to include enough empty space in the file for the virus to infect.
CIH used a special method of file infecting which caused the infected file not to grow at all, hence it looks like it is not infected on first sight. Anyway, best trojan ever made and that will ever be made.
@TheBIGOGHomie The method used was Cavity Infection, which was actually quite commonplace among Win9x viruses. The program I created was not infected because of it's size. I only write in assembly, therefore all my EXE's are tightly packed code with little space left over for anything let alone for the CIH virus, so it left it alone. Also it wasn't a trojan, but rather a virus (There is a big difference). Also, honestly, the only reason it's famous is for it's destructive payload.
Yes, it's true. CiH only works on DOS based Windows OS's (95, 98, ME) as they used a backwards compatible feature called VxD's or virtual system drivers to allow developers a lower level programming environment. This was eliminated though due mostly to the number of viruses created and the complexity.
@acount134 I have actually been infected by a CIH variant working on Windows XP and activating at the 26th of any month. There ain't no sample on Internert, though, it's WAY too rare.
@666666MetalHead There isn't any way for it to be on XP or any non-DOS system. Just because it went off on the 26th doesn't mean it's the Chernobyl virus. Many virus writers copy the work of others. Also remember that the Chernobyl virus is very specific in the fact it wiped the hard drive and scrambled the BIOS. Most likely you were infected by a trojan that coincidently went off every 26th, but was not the CiH virus. One more thing, the virus writer came forth before XP was released.
computer goes rabid, just blast it with a 12 gauge, problem solved. build a new PC!
jumbojokerjesse 6 days ago
FASM is Awesome!
TheBaDHD 2 weeks ago
Looks like a computer invented from 1998
TheLolasboy 3 weeks ago
AWESOME
TheBaDHD 1 month ago
on my birthday computers get destroyed
SuperSkillage 1 month ago
OMG! when I entered this video a virus alert poped-up in my monitor! o_O
olty49 4 months ago
umm wats up with the 2 mouses?
theyoshimarioguy 6 months ago
@theyoshimarioguy it's the screen recorder. There is one virtual mouse used in the VM and the actual mouse on my desktop. The screen recorder records both.
acount134 6 months ago
@theyoshimarioguy its just the virtual box thing becuase its captured
VBEducation1 5 months ago
@theyoshimarioguy One is the emulated virtual mouse, other is the actual mouse. By the way, it's mice, not mouses.
rinkavideos64 1 month ago
я создатель этого чуда :)
MrMAKKORs 7 months ago
The size didn't change because CIH uses "multiple cavity infection"-method (see wikipedia). In layman's terms, it uses empty pre-existent spaces in files.
KaxFin 7 months ago
@KaxFin I know what multiple cavity infection is and if there isn't enough slack space in the file, then IT WON'T INFECT IT! The CIH virus places a marker on every file it reads and if the file isn't able to be infected, it places a marker in the PE header stating so. I write only in Assembly Language so I control the size of each part of my executable and I chose not to include enough empty space in the file for the virus to infect.
acount134 7 months ago
u r using window 7 but it looks like millenium or win 98 how u do this
Rajput4408 8 months ago
@Rajput4408 this is windows 98 running in 7 via virtualbox
acount134 8 months ago
CIH used a special method of file infecting which caused the infected file not to grow at all, hence it looks like it is not infected on first sight. Anyway, best trojan ever made and that will ever be made.
TheBIGOGHomie 8 months ago
@TheBIGOGHomie The method used was Cavity Infection, which was actually quite commonplace among Win9x viruses. The program I created was not infected because of it's size. I only write in assembly, therefore all my EXE's are tightly packed code with little space left over for anything let alone for the CIH virus, so it left it alone. Also it wasn't a trojan, but rather a virus (There is a big difference). Also, honestly, the only reason it's famous is for it's destructive payload.
acount134 8 months ago
Windows 7 is vulnerable too.
theceterus 9 months ago
@theceterus no it's not.
acount134 9 months ago
@ButterJunge
Yes, it's true. CiH only works on DOS based Windows OS's (95, 98, ME) as they used a backwards compatible feature called VxD's or virtual system drivers to allow developers a lower level programming environment. This was eliminated though due mostly to the number of viruses created and the complexity.
acount134 1 year ago
@acount134 I have actually been infected by a CIH variant working on Windows XP and activating at the 26th of any month. There ain't no sample on Internert, though, it's WAY too rare.
666666MetalHead 11 months ago
@666666MetalHead There isn't any way for it to be on XP or any non-DOS system. Just because it went off on the 26th doesn't mean it's the Chernobyl virus. Many virus writers copy the work of others. Also remember that the Chernobyl virus is very specific in the fact it wiped the hard drive and scrambled the BIOS. Most likely you were infected by a trojan that coincidently went off every 26th, but was not the CiH virus. One more thing, the virus writer came forth before XP was released.
acount134 11 months ago
Do not ask me for the source of the virus or where I got it.
acount134 1 year ago
@acount134
Why not? It's freely available.
ButterJunge 1 year ago
@ButterJunge There are 39 versions of it. I can only help but prevent some from finding one.
acount134 1 year ago
@acount134
But they [versions of the virus] don't affect modern operating systems do they? I thought they only affected pre-Windows 2000 systems.
ButterJunge 1 year ago