The Chernobyl virus: the malware that fried your PC's BIOS

Today, 26 April, is a date history insists on marking with tragedy. In 1986, reactor number 4 at Chernobyl exploded and changed the meaning of nuclear catastrophe for ever. Thirteen years later, in 1999, another kind of silent explosion took place — this time inside millions of computers around the world. The CIH virus, nicknamed Chernobyl, triggered its destructive payload on exactly that date. And if you had a PC running Windows 95 or 98 that day, there was a good chance you woke up to a machine that simply refused to switch on.

A student, a virus and a wager

Chen Ing-Hau was 24 when he wrote CIH — and the virus's initials were no coincidence. They were literally his name: Chen Ing-Hau. A computer engineering student at Tatung Institute of Technology in Taipei, Taiwan, Chen created the virus in June 1998 in response to what he saw as arrogance among antivirus developers: they claimed software viruses would never be capable of genuinely damaging hardware. He wanted to prove them wrong.

And he did.

The trigger date, 26 April, was both his own birthday and the anniversary of Chernobyl. It's not entirely clear whether the coincidence was deliberate or whether Chen leaned into the symbolism afterwards — but the nickname "Chernobyl virus" stuck immediately, because the destruction it caused resembled a nuclear plant quietly exploding inside your computer.

The technique that left antivirus software blind

CIH was extraordinarily sophisticated for its time. Most file viruses back then worked by appending code to the end of an executable — which increased the file size and raised an obvious flag for any antivirus. Chen did it differently.

CIH was a cavity infector. It inspected Windows executables (in the PE, Portable Executable format) and looked for empty spaces between code sections. Every executable has those gaps: alignment padding the operating system leaves blank by convention. CIH fragmented itself and distributed the pieces through those holes, filling the gaps without increasing the file size. To a size-signature-based antivirus, the program looked untouched.

It circulated for months on pirated software CDs, game demos, files swapped on floppy disks and, as dial-up internet grew, in downloads. Silent, invisible, waiting.

The day the PCs died

On 26 April 1999, CIH triggered its double payload on machines running Windows 95 and 98.

The first payload overwrote the first megabyte of the hard drive with zeros. That destroyed the partition table — the map telling the operating system where each partition starts and ends. Without that map, Windows couldn't locate its own files. The machine went into a boot loop or simply refused to start.

That would have been catastrophic enough. The second payload was worse.

CIH attempted to write corrupted data to the motherboard's BIOS chip. In 1999, most BIOS chips were Flash ROM — rewritable by software, something manufacturers had implemented to make firmware updates easier. CIH used that very feature to overwrite the BIOS with rubbish. If it succeeded, the motherboard became incapable of booting anything at all. This wasn't a software problem a format would fix — it was destroyed hardware. The solution was to physically swap the BIOS chip or throw the motherboard away.

South Korea was hit hardest: more than $250 million in damages. It's estimated the virus infected up to 60 million computers worldwide, with hundreds of thousands triggering the destructive payload on that 26 April.

Why Chernobyl was different from everything before it

Before CIH, the conventional wisdom was clear: software viruses don't cause permanent damage to hardware. They could corrupt data, format disks, display annoying messages — but the metal was safe. A full format and a reinstall would fix any infection.

Chen proved that separation between software and hardware was an illusion resting comfortably on assumptions nobody had ever tested. The BIOS is the bridge between the two — and if you can write to it via software, you can turn a perfectly functional piece of hardware into a permanent brick with an executable of a few kilobytes.

It was the first malware in history to genuinely cross that line. And it opened a path later threats — firmware rootkits, and the infamous Mebromi, which infected the BIOS and survived a complete Windows reinstall — would follow years afterwards.

What happened to Chen Ing-Hau

Arrested in Taiwan shortly after the 1999 outbreak, Chen was charged. But Taiwan had no adequate cybercrime laws at the time — and he ended up convicted of nothing related to the virus. Years later, he worked for an information security company. The irony could hardly be more complete.

Today, 27 years after the big attack, CIH has museum-piece status. It only works on Windows 9x, which nobody runs in production any more. The Flash BIOS chip has been replaced by UEFI, with far more robust write protections. But the lesson Chen forced the world to learn — that hardware can be destroyed by malicious code — is as relevant as it ever was. Only the target has changed: router firmware, industrial controllers, chips embedded in critical equipment.

Chernobyl exploded in 1986. The Chernobyl virus exploded in 1999. On this 26 April 2026 — 40 years on from the reactor and 27 from the malware — the date still carries that weight of something you don't easily undo. Worth remembering. And, preferably, worth keeping your firmware updated — even if that wouldn't have been enough back then.

If you enjoy these darker milestones in computing history, there's more here on the blog: the BSOD that humiliated Bill Gates live at COMDEX happened in the same year CIH started circulating — 1998 was quite a year for Microsoft and for the world. And if you survived the Chernobyl virus (or the trauma of watching a PC simply stop switching on with no explanation), tell us in the comments.