Alias:Win32_Kriz, Win32.Kriz, W32.Kriz, W95/Kriz.4050
Type:Worm 
Size: 
Origin: 
Date:00-00-0000 
Damage:W95/Kriz.4050 infects various .exe files. These execute different actions when system restarts. 
VDF Version:  
Danger:High 
Distribution:Low 

Technical DetailsW95/Kriz.4050 infects .EXE files, excluding:
_AVP32.EXE
_AVPM.EXE
ALERTSVC.EXE
AMON.EXE
AVP32.EXE
AVPM.EXE
N32SCANW.EXE
NAVAPSVC.EXE
NAVAPW32.EXE
NAVLU32.EXE
NAVRUNR.EXE
NAVWNT.EXE
NOD32.EXE
NPSSVC.EXE
NSCHEDNT.EXE
NSPLUGIN.EXE
SCAN.EXE
SMSS.EXE

The next time Windows is started, the infected file KERNEL32.DLL will infect some functions with the virus code. Thus, 16 "KERNEL32" functions are infected:
open file
copy
delete
modify file settings etc.

For infecting KERNELL32.DLL, the virus saves this file as KRIZED.TT6 and then changes it. By the next system start, the file KERNEL32.DLL is replaced with KRIZED.TT6, thanks to an entry made in WININIT.INI.


The virus has an additional damage routine in its code: on December, 25th, the CMOS memory crashes, all files of the drive are overwritten and it tries to crash Flash BIOS.
Die Beschreibung wurde erstellt von Crony Walker am Dienstag, 15. Juni 2004

zurück . . . .