"Kriz" virus returns home for holidays
"Kriz," a year-old computer virus, may be coming back for Christmas this year, thanks to its ability to piggyback on other viruses and spread with them.
The Kriz virus, also known as the "W32.Kriz," is based on the "CIH," or "Chernobyl," virus, which damaged computers worldwide when it was triggered April 26, 1998. Antivirus software maker Symantec on Tuesday warned people to scan their computers before Christmas; the company released a free tool to scan for the virus and remove it.
"Worms by their nature propagate pretty quickly," said Marian Merritt, group product manager for Symantec. "And when they get on a computer with Kriz, they start spreading that."
Symantec and other antivirus software already scan for the virus in their standalone programs.
The Kriz virus spreads to a computer when someone opens an infected file, changing the basic program that runs the operating system, known as the kernel. The virus also infects other programs on the computer's hard drive and any mapped drives, leaving open the possibility that it could travel across company networks.
"It may have spread itself to all your executables, but you are only a carrier of the virus," said Symantec's Merritt. "The real payload hits on Dec. 25."
When the virus triggers, it overwrites all files on the computer and then attempts to erase the software foundation of the PC, known as the basic input-output system (BIOS). Although the BIOS attack only occasionally works, the other attacks can be extremely destructive.
Symantec rival Trend Micro said it believes the virus will not spread far but warns that its ability to combine with other viruses could change that.
Both Trend Micro and Symantec reported that the virus has infected two other worms: "Happy99.worm," also known as "W32.Ska," and "W32.hllw.bymer.worm."
"Kriz is a destructive virus but a really slow infector," said Joe Hartmann, antivirus researcher for Trend Micro. "Yet it's now infected a mass mailer, so now you have a destructive virus that's also a mass mailer."
In the past 24 hours, Kriz ranked No. 8 on Trend Micro's Worldwide Virus Tracking Center in terms of how many files the virus had infected. The tracking center is a real-time database of the types of viruses found by Trend Micro's online House Call scanner.
In North America, the virus ranked No. 6 for files infected. Despite that, the virus has not yet spread widely and is known to have infected about 50 computers in the last 24 hours. Because the tracking center only follows viruses that have infected people who use Trend Micro's online service, the actual number could be much greater.
Historians are taking heed, however.
The Kriz virus is essentially a copy of the CIH virus, which was created in 1997 by Cheng Ing-Hau of Taiwan. CIH fizzled in its first year, and a variant that struck every month died out quickly. However, the annual variant did significantly more damage when it was triggered in April 1998.