This virus infects .EXE files in Windows 95/98. It becomes memory resident once a file is executed.
    When the virus infects files, it looks for spaces in the target file and appends itself to those unused spaces, so that the size increase of infected files is hardly noticeable.
It also hooks the IFS (Installable File System), which gives it the ability to infect any PE (Portable Executable, e.g., .EXE) type files. Windows NT files, however, are not subject to infection (by PE_CIHV1.2) due to the use of a VXD programming technique (used when it becomes memory resident): this technique is available in Windows 95/98 only. Therefore, Windows NT systems are safe from the Chernobyl infection.
    A couple destructive payloads that are triggered on the 26th day. On the trigger day, it attempts to overwrite the system's hard disk with some random data, and that makes data recovery very difficult. It also tries to do some permanent damage to the system by corrupting data stored in the Flash BIOS.
    One the hard drive has been reformatted (by PE_CIHV1.2), the following message is displayed when the system is rebooted:
DISK BOOT FAILURE,
INSERT SYSTEM DISK AND
PRESS ENTER
And if you boot the system from A: drive and try to change to C: drive for there, another message is displayed:
Invalid drive specification
Since the hard disk has already been overwritten with some random data.

    In general, this virus appears to be fairly widespread. It has appeared on nearly every antivirus vendor's "Top Ten Viruses In-The-Wild" list. That, combined with the potential danger of its payload, makes it a concern.
    The good news is that this virus has been around since early 1998, meaning that every antivirus vendor is aware of the virus and has developed a solution.
    Use an updated antivirus scanner religiously should be protected from this virus. Because this virus goes memory resident and tends to infect Windows system files, it is most effectively removed by scanning from DOS or by booting from an emergency recovery disk provided from your antivirus vendor.
    The virus cannot go memory resident in NT, so that concern does not apply in an NT environment.
    This payload requires that the computer be using a flashable BIOS, which was not used in earlier-model BIOS chips. If you are using a 386 or early model 486 machine, you are most likely safe. Most, if not all, Pentium-based motherboards will have a flash BIOS, and many are susceptible to this payload. On some systems, writing to flash memory can be disabled by a DIP switch or a jumper cable. If you are concerned about this payload, you may want to investigate this option by contacting the manufacturer of your BIOS.
    There are many factors that can cause this payload to be unable to activate, even if the BIOS is flashable.
    The payload of overwriting the first megabyte of data is independent of the ability to overwrite flash BIOS and could affect any system running Windows 95 or 98.