One of the most dangerous viruses is back in time for Christmas 2000, thanks in part to other worms that may have spread it throughout the year.
Although the Kriz virus was first discovered in late 1999, it is believed to have infected files that other, more recent worms such as Bymer have spread across the Internet throughout the year.
Therefore, several anti-virus software companies are now warning users to scan their PCs in advance of its December 25th trigger date.
Kriz (W32.Kriz) infects Windows 95, 98, NT and 2000 systems and carries a destructive payload similar to CIH such that Kriz will destroy files on floppy disks, hard drives, network drives, as well as the computer's BIOS. At present, Kriz ranks a 6 on the ZDNet virus metre.
How It Works
The Kriz virus arrives as an infected file, which may be a file copied from another computer on a network or from a floppy or sent as an attachment to an e-mail.
Kriz carries an infected copy of KERNEL32.DLL, which lives in the Windows/System folder.
Kriz creates its own folder Windows/System/Krized.tt6, and adds a line to Winint.ini to look there for the infected copy of KERNEL32.DLL.
The Kriz-infected copy of KERNEL32.DLL allows the virus the following functions:
-CopyFileA
-CopyFileW
-CreateFileA
-CreateFileW
-CreateProcessA
-CreateProcessW
-DeleteFileA
-DeleteFileW
-GetFileAttributesA
-GetFileAttributesW
-MoveFileA
-MoveFileW
-MoveFileExA
-MoveFileExW
-SetFileAttributesA
-SetFileAttributesW
When Kriz is resident in memory, these functions allow any recently run executable file to become infected with Kriz.
If an infected executable file is run on December 25th, Kriz will erase the computer's CMOS, which contains information such as date and time, and what type of hard disk the computer uses.
It will also erase the contents of any floppy disks, hard drives, and networked drives.
It will also attempt to flash the computer's BIOS with garbage.
This only works on some BIOS. If it is successful, however, the computer will no longer boot and its motherboard will have to be replaced.
Removal
Kriz has been around long enough that all the anti-virus software companies have detection and removal software available.
For example, Symantec offers an online tool for users using Internet Explorer or Netscape.
