ticalc.org
Basics Archives Community Services Programming
Hardware Help About Search Your Account
   Home :: Archives :: News :: Win95.CIH Spotted In 83PlusAsm v1.01

Win95.CIH Spotted In 83PlusAsm v1.01
Posted by Nick on 23 March 2000, 23:37 GMT

Well.. this is a piece of sour news. From bombing the chem test to getting waitlisted at Washington University to this. Last night, a file was added that contained the Win95.CIH virus. THIS FILE WILL CAUSE YOUR SYSTEM TO CEASE FUNCTIONING ON THE 26TH OF ANY MONTH! For those of you who can't tell the emboldened red text apart from everything else, this is a very bad thing. The program was called 83PlusAsm v1.01; it had 255 downloads before we removed it from our archives. If you downloaded this file, do a virus scan of your machine IMMEDIATELY or head to this page to get an online scan of your system. If you have any problems with disinfecting your system, head over to this page or email me.

DO THIS PROMPTLY - Win95.CIH WILL RENDER YOUR MACHINE INOPERABLE AFTER MARCH 26TH!

We apologize for any problems this may cause anyone. Any other TI sites - scan your systems if you added this file. Once again, if you have ANY problems with getting this virus off your computer, email me and I'll try to make my response as prompt as possible.

Update (Nick): An esteemed colleague, David Hall, has informed me of a free virus scanner with free updates. You can find a copy of it here.

Update (Nick): Another kind-hearted person, Matt, has given me the linkage to a disk recovery tool called SpinRite. This can even be used after the virus goes off. I don't know how much it can help people, but it's there. (Updated with correct link)

 


The comments below are written by ticalc.org visitors. Their views are not necessarily those of ticalc.org, and ticalc.org takes no responsibility for their content.


Re: Win95.CIH Spotted In 83PlusAsm v1.01
DWedit  Account Info
(Web Page)

I think the virus is CIH v1.2, which only works on april 26. But I might be wrong

     24 March 2000, 06:34 GMT

Re: Win95.CIH Spotted In 83PlusAsm v1.01
peoples_champ  Account Info

Good job Nick on finding the virus.

But one question, Why the hell didnt you check fo this earlier. You have probably ended up destoying several thousand hard drives and some people probably do not even know about it. Well at least you found it and we all have at least two days before doomsday on our computers

     24 March 2000, 22:46 GMT

Re: Re: Win95.CIH Spotted In 83PlusAsm v1.01
JaggedFlame

not several thousand, more like 255. anyway, two days is more than enough time to go get a trial virus scanner (or even a free one - go to http://antivirus.cai.com/) and fix it.

Anyway, leave the guy alone! Wasn't his fault...

     24 March 2000, 23:18 GMT


Re: Re: Re: Win95.CIH Spotted In 83PlusAsm v1.01
JaggedFlame

darn, guess i'm not an esteemed colleague - i posted the address of the free virus scanner before the "update" got posted to the article, but of course they have to wait until someone they actually *know* gives them the address... oh well who cares.

     25 March 2000, 18:59 GMT


Re: Re: Re: Re: Win95.CIH Spotted In 83PlusAsm v1.01
David Hall  Account Info
(Web Page)

Hey! Calm down m8!
1) Nick probably doesn't have time to read every single post on this board - I only skim read it myself. It is possible he didn't see your post.
2) I posted a few times on this board about this free scanner too :)
3) Who cares who got the update? At least users now know about the free scanner!
Next time, you could email him :)

     26 March 2000, 16:45 GMT


Re: Re: Win95.CIH Spotted In 83PlusAsm v1.01
Kirk Meyer  Account Info
(Web Page)

How about you read all the other comments, hm? ticalc.org scans every file before it can even be dealt with on their computer. Their signatures were just out of date.

     25 March 2000, 00:26 GMT

Re: Win95.CIH Spotted In 83PlusAsm v1.01
mad_scientist86  Account Info

am i safe if i downloaded it, unziped it and left it a couple days before deleting it but, never ran it??

     25 March 2000, 04:58 GMT


Re: Re: Win95.CIH Spotted In 83PlusAsm v1.01
David Hall  Account Info
(Web Page)

No, you're not :(

Download and run InoculateIT from http://antivirus.cai.com/ - its free, and you get free updates :)

     25 March 2000, 14:33 GMT

Re: Re: Re: Win95.CIH Spotted In 83PlusAsm v1.01
mad_scientist86  Account Info

I just downloaded the newest files for my McAfee virus scan, scanned my whole computer, and it said there was no virus found. so is it still hiding in my computer somewhere??? when was TI83+ asm version 1 uploaded?

     25 March 2000, 19:07 GMT


Re: Re: Re: Re: Win95.CIH Spotted In 83PlusAsm v1.01
Jeff Chai  Account Info

According to what I know from McAffee, if you didn't run the infected program and a scan for the virus turned negative results, you should be Okay.

     25 March 2000, 20:05 GMT


Re: Re: Re: Win95.CIH Spotted In 83PlusAsm v1.01
Andy Lundell Account Info
(Web Page)

Yes he is!

If you don't run the infected program you can't get the virus. It's just data until you execute it. I don't understand why the concept of a computer virus is so difficult to understand. It's fragment of a program that adds itself to other programs.

ie :
Original program :
10 Start Program
20 Do Cool Stuff
30 End
Infected program :
10 Start Program
11 Copy virus to other programs
12 Decide whether to do nasty stuff
20 Do Cool Stuff
30 End

But if you don't run the program lines 11 & 12 don't get executed and nothing happens.
Boot-Sector viruses and Macro viruses are slightly different but work on similar principles. (Boot viruses infect your HD's Boot Sector and infect floppys but not files., Macro viruses work on macro's instead of machine code. (ie MS Word Macros) )

     25 March 2000, 21:13 GMT

Re: Re: Re: Re: Win95.CIH Spotted In 83PlusAsm v1.01
David Hall  Account Info
(Web Page)

> Yes he is!
>If you don't run the infected program you can't get the virus

He said he would unzip ot and -place it in a directory for a while before running it. I'm sorry, but clearly that would not make him safe!

     25 March 2000, 23:06 GMT


Re: Re: Re: Re: Re: Win95.CIH Spotted In 83PlusAsm v1.01
Andy Lundell Account Info
(Web Page)

He said he NEVER RAN IT. Then he DELETED it. So therefor he is safe.

     26 March 2000, 05:14 GMT

Re: Re: Re: Re: Win95.CIH Spotted In 83PlusAsm v1.01
David Hall  Account Info
(Web Page)

Heh, soz - you're right - I misread it. :)

     25 March 2000, 23:09 GMT


Re: Re: Re: Re: Re: Win95.CIH Spotted In 83PlusAsm v1.01
Andy Lundell Account Info
(Web Page)

I gotta remember to read all replys before replying myself...

     26 March 2000, 05:15 GMT

Re: Re: Re: Re: Win95.CIH Spotted In 83PlusAsm v1.01
mad_scientist86  Account Info

thats what i thought
ti calc should make a chat room

     26 March 2000, 06:08 GMT


Re: Re: Re: Re: Re: Win95.CIH Spotted In 83PlusAsm v1.01
Jxxh67  Account Info

i agree. ~~A place where the TI community could gather and share the wealth of knowledge that each and every one of us possess, to lend a helping hand to those in need, and argue over which calculator is better:)~~

Ahh...A boy can dream, can't he?

     26 March 2000, 07:54 GMT


Re: Re: Re: Re: Win95.CIH Spotted In 83PlusAsm v1.01
Samir Ribic  Account Info
(Web Page)

:If you don't run the infected program you can't get :the virus

Do not say twice. It is possible to infect your system by simple TYPE README.TXT ! How?

If you have installed ANSI.SYS it has escape sequences. Some of them can redefine your keyboard.
It is possible to redefine ENTER key, for example, to do:

1) Install virus
2) Redefine ENTER to normal function

Today few users install ANSI.SYS, but many older texts and programs depend on it.

     26 March 2000, 10:33 GMT


Re: Re: Re: Re: Re: Win95.CIH Spotted In 83PlusAsm v1.01
Andy Lundell Account Info
(Web Page)

Realy, I wasn't aware of this.

But it's still a stretch. Because :

a) does anyone know of viruses that modify readme files? If not, it would have to be malicously put there.
b) A small,declining number of people use Ansi.sys
c) A small,declining number of people use type
d) An near-zero number of inexperianced users use both Ansi and type.
f) If the cool program you just downloaded started runing itself automaticaly you'd start to wonder.
g) Anyone who didn't use type(or similer) and ansi.sys to view the readme would notice the extra code and spread the word.

So I wouldn't be to concerned about this. It's an interesting idea though. I'd personaly be much more worried about macro viruses and the like. Esp. as word procesor macro languages seem to be geting more and more powerfull.

     27 March 2000, 21:45 GMT

Fools!!!!
ikecam  Account Info
(Web Page)

First of all, anyone out there that thinks Jeff Chai intentionally put the virus in the file is OBVIOUSLY an idiot. If he wanted to sabotage the TI community, he wouldn't have put his name on the file or taken responsibility for it. People need to stop jumping to conclusions.

Secondly, if you own an 83+, you deserve a virus anyway.

     25 March 2000, 05:09 GMT

Re: Fools!!!!
Jxxh67  Account Info

lol:)

89 all the way...

     25 March 2000, 06:40 GMT


Re: Re: Fools!!!!
nova  Account Info

Hell ya!!!
89's are the supreme calculator!!

     25 March 2000, 08:28 GMT


Re: Re: Re: Fools!!!!
Anubis  Account Info

You are BOTH in error. A 92+ will spank everything else on the market for the resolution alone. And has anyone tried to type a real program on that "keyboard"? Sure you can use the graph-link software but you dont always have a computer handy...

Only an opinion
-Anubis

     25 March 2000, 18:33 GMT

Re: Re: Re: Re: Fools!!!!
Reno  Account Info

the 86 owns all TI's by means of an extremely efficient menu system, great programs, emulation, and no kernel-specific programs (and it has a good amount of memory, too). If it had a CAS, it would own all other calcs; thats probably the area where the 86 falls short of an 89/92(+).

     25 March 2000, 21:16 GMT

Re: Re: Re: Re: Re: Fools!!!!
Jeff Chai  Account Info

First off, lets compare and contrast the two calculators:

TI-89 TI-92 Plus
Memory- Same same
Archive Mem- Yes Yes
Compact Size- Definetly NO
Use on SAT's
(all tests)- Yes NO
Screen Size- Small Big

Overall, the TI-89 is the same as the TI-92 Plus. The TI-89 is like a TI-83 Plus on steroids and the TI-92 Plus is a flat out Laptop. Though who wouldn't want a TI-92 Plus? =) If you're a guy (or girl) who needs a fully functional high performance calc, get an 89. If you have some need to feel BIGGER (literally) than everyone else, get a 92 Plus.

P.S - I own a TI-89. YEEEAAAAHHH!

     25 March 2000, 23:18 GMT


Re: Re: Re: Re: Re: Re: Fools!!!!
Jxxh67  Account Info

that ti-92+ does you alot of good when you have to leave it at home because you cant use it on any tests!But thats your preference if you like to lug it around. As far as practicality, the 89 IS the way to go. i love my 89...

     26 March 2000, 05:07 GMT


Re: Re: Re: Re: Re: Fools!!!!
ikecam  Account Info
(Web Page)

Despite the fact that I only own an 86, I have to disagree. There's not only the CAS, but also the flash rom and the 3D grapher. (On that note, if someone would ASMized Func3D, we'd be in damn good shape.) The 89 is a very nice calculator for a lot of reasons and I wish I had one.

     26 March 2000, 20:54 GMT


reply to all the replies
Anubis  Account Info

While it is true that you cannot use a 92+ on most tests (the standardized tests like SAT are what I am referring to), where I am (Tennessee) you can't use 89's either. Therefore, there is no value of an 89 over a 92+, other than size. While most of the features are the same, the 92+'s size does have advantages in my opinion. The larger keyboard has all F1-F8 keys (as opposed to 2nd+F1), and the qwerty keybaord is VERY handy (for programming purposes, too, more getkey values are easier to get to). A friend of mine has an 89, one he is very proud of. I find that people would rather use mine than his simply because my screen is easier to read and I have a keyboard while he doesn't. I still maintain the larger viewing screen is a definite plus. 86's are very nice indeed (several of my friends have those), but I dont think they come close to either 89/92+ because the latter have a LOT of useful built-in functions. Does ANYONE out ther have a 92+ and agree with me?

Again, only an opinion
-Anubis

     27 March 2000, 03:38 GMT

Re: Fools!!!!
Juan Corral  Account Info
(Web Page)

>> Secondly, if you own an 83+, you deserve a virus anyway.
Heh, ah man, those poor TI-83+ owners who want to learn ASM...

I agree with you, it wasn't Jeff Chai's fault. And everyone should run Virus Scanning software on anything they download. I personally do not have any, as I only download misc. programs in Linux. And if I happen to download a Windows program, I will get it from a big website like Download.com, Hotfiles.com, or Tucows, as they run virus checking software before hand.

If anyone got infected from ths file, I'm sorry for you.

     25 March 2000, 07:02 GMT

Re: Re: Fools!!!!
nova  Account Info

I have a guy in my math class that refuses to upgrade his 83+. I tell him he's a complete idiot because upgrading is basically the whole purpose of an 83+. Why didn't he buy a normal 83? He would have saved a lot of money.

     25 March 2000, 08:31 GMT


Re: Re: Re: Fools!!!!
Etec  Account Info
(Web Page)

really. only a retard wouldn't upgrade their calculator if they had the chance to.

     26 March 2000, 00:54 GMT


Re: Re: Re: Re: Fools!!!!
Matt Hockenheimer  Account Info

Unless they had an 89. Then, only someone (like me) who hadn't read all the news items, etc saying that anyone with AMS 2.03 was basically screwed would upgrade it. Though it does have some nice features if you program in basic. But they don't make up for the incompatability (Though at least my favorite program, TI-Chess, works fine :).

     26 March 2000, 03:12 GMT


Re: Re: Fools!!!!
David  Account Info
(Web Page)

I have a TI-83, TI-83 plus (TI-83 was falling apart), and a TI-89. The TI-83+ is a fine calculator (though I would scream if my 89 was to die in the middle of a math test). It's powerful enough that the average user probably wouldn't benefit from the extra features found in the more powerful calcs, and it's the most common calc that high schools use today. That's why people would be wanting to learn TI-83+ asm. And to Jeff Chai: As others have already said, it wasn’t your fault. I hope that this will not stop you from submitting more things in the future.

     26 March 2000, 05:02 GMT

Re: Fools!!!!
Skiddy
(Web Page)

I agree with the first part, but not the second. People should feel free to buy any Texas Instrument they like without you abusing them.

     25 March 2000, 08:42 GMT

Re: Re: Fools!!!!
Jxxh67  Account Info

lighten up! ....I really dont think he meant that for real....

     25 March 2000, 18:12 GMT


Re: Re: Re: Fools!!!!
ikecam  Account Info
(Web Page)

Just for the record, it was a joke.

     25 March 2000, 20:48 GMT


Re: Re: Re: Re: Fools!!!!
Etec  Account Info
(Web Page)

Yea that was a joke. Lets see, next time why don't you put some type of sign to indicate that. Anyway That trojan was also a joke, see how you like that. I still stand by my statement that people shouldn't pick on a calculator for no reason.

     26 March 2000, 00:57 GMT


Re: Re: Fools!!!!
Etec  Account Info
(Web Page)

amen

     26 March 2000, 00:55 GMT


Re: Fools!!!!
Etec  Account Info
(Web Page)

oh f^&*, here we go again. What the hell is wrong with you, you must like starting ti wars. The TI-83 Plus is a good calculator, if you would give it a chance and if it is all you need. Owning a more advanced calculator when you don't need it makes you the idiot. You should post a reply saing "durrr, I'm ikecam and I'm an alcaholic, I have a dizease and they don't know what to call it." I'm tired of jackasses picking on the 83 Plus for no reason. Anyway, what the hell are you doing on this board, this has nothing to do with the 89,92, 85, 86, or any other calc. This has to do with the infection of a file about **the 83 Plus**.

P.S. ikecam, next time you come on this site your computer will download a 1k trojan which will enable me to remotely control your computer. Don't worry I'll only send a command to your Autoexec.bat file and add the command 'del win.com'. I'm sorry this will cause your computer not to boot windows. But please don't be afraid, you can still recover from dos, then next time I'll do something even more brutal.

     26 March 2000, 00:50 GMT

Re: Re: Fools!!!!
ikecam  Account Info
(Web Page)

Why the hell do you always take this calculator stuff so seriously? If someone has a low opinion of your calculator, that shouldn't be a big deal to you. I'm insulting your graphing device, not you (unless, of course, you've become physically fused with you calculator--but that's your problem). I insult your calculator and you respond by insulting me. I think you need to calm down a little.

And it should be obvious that I'm joking when I say someone deserves a calculator virus. But with you, one can never tell...

     26 March 2000, 20:48 GMT


Re: Re: Fools!!!!
brentes
(Web Page)

Dude, why don't YOU lighten up.. you REALLY take this seriously. Take and 89 or 86, and take an 83, use them, then choose. You'd take the 89 or 86. BELIEVE ME. I have all 3.

     27 March 2000, 02:38 GMT

1  2  3  4  5  6  

You can change the number of comments per page in Account Preferences.

  Copyright © 1996-2012, the ticalc.org project. All rights reserved. | Contact Us | Disclaimer