Several variants of the Bolzano virus do not only replicate, but also attack the Windows NT file security system. It uses a new strategy that may be used by NT viruses in the future. The attack does not work on any betas of Windows 2000, but it remains feasible. In order for the virus to attempt the attack, it needs administrative rights on a Windows NT Server or Windows NT Workstation during the initial infiltration. Therefore it is not a major security risk, but still is a potential threat.
Viruses can always wait until the Administrator or someone with the equivalent rights logs on.
The virus modifies only 2 bytes in a security API called SeAccessCheck that is part of ntoskrnl.exe. This way Bolzano is able to give full access to all users to each file regardless of its protection, whenever the machine is booted with the modified kernel. This is a potential problem since the virus can spread everywhere it wants to regardless of the actual access restric tions on the particular machine. Furthermore after the attack, no data can be considered protected from any user. Unfortunately the consistency of ntoskrnl.exe is checked in only one place.