Win95.CIH Spotted In 83PlusAsm v1.01
Posted by Nick on 23 March 2000, 23:37 GMT
Well.. this is a piece of sour news. From bombing the chem test to getting waitlisted at Washington University to this. Last night, a file was added that contained the Win95.CIH virus. THIS FILE WILL CAUSE YOUR SYSTEM TO CEASE FUNCTIONING ON THE 26TH OF ANY MONTH! For those of you who can't tell the emboldened red text apart from everything else, this is a very bad thing. The program was called 83PlusAsm v1.01; it had 255 downloads before we removed it from our archives. If you downloaded this file, do a virus scan of your machine IMMEDIATELY or head to this page to get an online scan of your system. If you have any problems with disinfecting your system, head over to this page or email me. DO THIS PROMPTLY - Win95.CIH WILL RENDER YOUR MACHINE INOPERABLE AFTER MARCH 26TH! We apologize for any problems this may cause anyone. Any other TI sites - scan your systems if you added this file. Once again, if you have ANY problems with getting this virus off your computer, email me and I'll try to make my response as prompt as possible. Update (Nick): An esteemed colleague, David Hall, has informed me of a free virus scanner with free updates. You can find a copy of it here. Update (Nick): Another kind-hearted person, Matt, has given me the linkage to a disk recovery tool called SpinRite. This can even be used after the virus goes off. I don't know how much it can help people, but it's there. (Updated with correct link)
|
|
|
The comments below are written by ticalc.org visitors. Their views are not necessarily those of ticalc.org, and ticalc.org takes no responsibility for their content.
|
|
Re: Win95.CIH Spotted In 83PlusAsm v1.01
|
Hieu-Trung Le
(Web Page)
|
Man who the hell is the author of that file? probably trying to trick us and make us have the virus... =(
|
|
23 March 2000, 23:50 GMT
|
|
|
|
|
|
|
|
|
|
|
Re: Don't take this the wrong way...
|
Jeff Chai
|
No, the virus is not in the original file. Here is the source in C for the ObjHex program:
// This program converts an object file into a hexdecimal file
// Include header files
#include <stdlib.h>
#include <stdio.h>
#include <malloc.h>
// Main program starts here
int main( int argc, char **argv )
{
FILE *obj_in; // Declare a file pointer
unsigned char byte_in; // A byte buffer
static char hex[] = {"0123456789ABCDEF"}; // ASCII code
int hi, lo, i; // high, low nibbles and index
// Open the object file using name in argv[]
if( (obj_in = fopen(argv[1],"rb" )) == NULL )
{
// NULL returned, file does not exist.
fprintf( stderr, "Couldn't open %s\n",argv[1] );
return 1;
}
i = 1;
while( !feof(obj_in) ) // While Not End-of-file, loop
{
// Get one unsigned character from file
byte_in = fgetc( obj_in);
if (!feof(obj_in)) // not an EOF character
{
// Shift right 4 bits to get the high nibble
hi = byte_in /16;
// Mask off high nibble to get the low nibble
lo = byte_in & 0xF;
// Put the corresponding Hexdec charecter out
fputc( hex[hi], stdout );
// Put the corresponding Hexdec charecter out
fputc( hex[lo], stdout );
if (i > 5) // Put a new line character every 6 bytes
{
i = 0;
fputc ('\n',stdout);
}
++i;
} // End if
} // End of loop
// DONE, close file
fclose(obj_in);
return 0; // Return 0 to indicate a normal return
} // End of program
I am not taking this the wrong way. I didn't intentionally upload a virus. Now that my reputation has been ruined, I am also facing problems with people who want to "get even" even though I didn't put a virus in. I just wanted to share a piece of quality work to help people. I guess I won't be doing that anytime this century...
Jeff
|
|
24 March 2000, 22:11 GMT
|
|
|
|
|
Re: Re: Win95.CIH Spotted In 83PlusAsm v1.01
|
Jeff Chai
|
To the entire TI calculator Community,
As you already know, I am the author of the help file and the creator of the ObjHex program. To sum up what I've said in comments throughout this page, I did not put the virus in the file. For those of you out there who believe me, thank you. For those of you who still have doubts, I will try to explain the most logical answer to this problem.
The file, as you know, is uploaded through the site's FTP (File Transfer Protocol). The Win95.cih virus has been known to automatically attach itself to unsuspecting files, according to a McAffee consumer services spokesperson. So while uploading the file, the Win95.cih virus attached itself to my file. Which explains why the virus isn't on my computer. As Nick said, the ticalc server has been without protection (from viruses, etc.) for a while. This isn't their fault. So the virus may have been lingering on the FTP.
If the Win95.cih virus has infected your computer, delete the affected .exe file(s). I will gladly help anyone having trouble removing it. Please e-mail me at ecchai@netzero.net.
This has been a very dissapointing day for me. To see my hard work infected by Win95.cih and then unusable is devastating. For those of you who still trust me and want to learn TI-83 Plus Asm, I will be releasing a newer version of these tutorials that will use Obj83 instead of ObjHex which can be downloaded from Ticalc bug free. There will be an HTML version hopefully posted here soon. I hope Nick is still up to putting it up.
If the Win95.cih virus damages any of your computers, I'm truly sorry it happened. But as you can see, It is not something I could have really prevented. I just don't know why these things happen to me... nor do I know how people could create viruses that could do things like this.
Best wishes to all.
Jeff L. Chai
|
|
25 March 2000, 04:37 GMT
|
|
Re: Win95.CIH Spotted In 83PlusAsm v1.01
|
Native
|
Whoa-I'm glad I don't have an 83+ =)
|
|
24 March 2000, 00:07 GMT
|
|
1 2 3 4 5 6
You can change the number of comments per page in Account Preferences.
|