IBM Aptiva PCs shipped CIH virus

In April 1999, IBM warned that some Aptiva consumer PCs sold in the United States had shipped with CIH already on the machine. The affected systems were not infected after purchase through a download or email attachment. They left the manufacturing path dirty.

The scope was narrow but serious. Contemporary reports named Aptiva models 240, 301, 520, and 580 manufactured between March 5 and March 17, 1999; IBM's own service bulletin narrowed those to the Aptiva E Series, machine types 2158 and 2163. The affected labels used AM909, AM910, or AM911 after MFG DATE, giving customers a practical way to identify machines at risk.

CIH was a Windows 95 and Windows 98 PE file infector. It hid in unused space inside executable files, stayed resident after execution, and infected other programs as the system opened or ran them. Its payload made the case dangerous: on the trigger date it could overwrite hard-drive data and attempt to corrupt writable Flash BIOS firmware.

IBM said it contacted most affected customers and provided an eradication program. The timing was poor. The machines shipped in March; the common destructive trigger was April 26. A factory image had become the distribution channel for a virus built to damage both files and boot firmware.