A | B | C | D | E | F | G | H | I | J | K | L | M | N | O | P | Q | R | S | T | U | V | W | X | Y | Z | Encyclopedia Home
Also see: Hoax Encyclopedia | Repair Center | News Briefs | Glossary | Infected Attachments | Prevention Center
|
Kriz
_AVP32.EXE, _AVPM.EXE, ALERTSVC.EXE, AMON.EXE, AVP32.EXE, AVPM.EXE, N32SCANW.EXE, NAVAPSVC.EXE, NAVAPW32.EXE, NAVLU32.EXE, NAVRUNR.EXE, NAVWNT.EXE, NOD32.EXE, NPSSVC.EXE, NSCHEDNT.EXE, NSPLUGIN.EXE, SCAN.EXE, SMSS.EXE
Kriz delivers a damaging payload on December 25th of any year. F-Secure warns that, on that date, when infecting any file, the virus kills CMOS memory, overwrites data in all files on all available hard drives and then tries to destroy Flash BIOS by using the same routine that the CIH (aka Chernobyl) virus has.
How to prevent it: Keep your antivirus software definition files updated. Reports have circulated indicating that Kriz may have cross-infected an Internet/email worm. Never open attachments received unexpectedly. Scan all newly received files before opening or use on-access scanning to perform automatic scans of all opened files.
Aliases: W32.Kriz, Win32_Kriz
Type: memory resident polymorphic virus
Systems Affected: Windows 32-bit systems
Payload: On 25th of December, erases CMOS memory and overwrites files on hard drive
ITW: Yes
Origin:
Description: According to F-Secure, Kriz is a memory resident polymorphic virus that infects portable executables (PE EXE) files with EXE and SCR extensions. By also infecting KERNEL32.DLL, Kriz is able to stay resident in memory. Kriz does not infect files with the following names:
How to Detect/Remove Kriz: If you have a license for antivirus software, update it and scan your system thoroughly. If you do not have antivirus software, Command Software provides a free online scanner capable of detecting and removing Kriz from your system.
