# MA-013.081999: MyCERT Advisory - W32/Kriz Virus

**Date:** 20 Aug 1999  
**Source:** https://www.mycert.org.my/portal/advisory?id=MA-013.081999  
**Advisory ID:** MA-013.081999

---

1.0 Description
#### 1.1 Overview
The W32/Kriz, a polymorphic virus, infects Windows 95/98/NT PE EXE files with .EXE and .SCR extensions. It has similar payload as with the CIH virus but with a more destructive capabilities ie erasing the computer's CMOS information and infecting the Windows KERNEL32.DLL system library. In addition, the virus is able to overwrite all files on all available hard drives including mapped drives. The payloads triggered on December 25th which subsequently will result a significant loss of data and make the infected computer unbootable.
#### 1.2 Limitation
It is a memory resident polymorphic Windows 95/98/NT virus.
Infects PE EXE files with EXE (executables) and SCR (screensavers) extensions and Windows KERNEL32.DLL system library.
### 2.0 Technical Matters
#### 2.1 Installation
When an infected file is run on a clean machine, the virus checks KERNEL32.DLL to see if it is infected, if yes then the virus exits. If KERNEL32.DLL is not infected then the virus copies KERNEL32.DLL to WINDOWS\SYSTEM\KRIZED.TT6 and then the virus infects the local copy.
The virus then creates the files WINDOWS\WININIT.INI containing the lines:
C:\WINDOWS\SYSTEM\KERNEL32.DLL=C:\WINDOWS\SYSTEM\KRIZED.TT6
This causes the windows to replace KERNEL32.DLL with the infected copy when the system is next re-started.
In the infected copy of KERNEL32.DLL, the virus hooks the following functions:
CopyFileA
CopyFileW
CreateFileA
CreateFileW
CreateProcessA
CreateProcessW
DeleteFileA
DeleteFileW
GetFileAttributesA
GetFileAttributesW
MoveFileA
MoveFileW
MoveFileExA
MoveFileExW
SetFileAttributesA
SetFileAttributesW
This causes any PE executable file that is run, copied, moved or scanned to be infected by this virus.
#### 2.2 Functionality
When the infected file is executed, the virus will infects KERNEL32.DLL and replaces the original file content with the contents of the virus the next time it rebooted. This action will allow the virus to stay memory resident - within a computer's memory all the time - during an entire Windows sessions. Any application that are opened while the virus is still in memory, will be infected by the virus. As a result, KERNEL32.DLL cannot be repaired and must be replaced.
There are also variants of this virus. Some of the differences between variants pertain to the payload. Other differences include multiple methods of infection. One variant will create a new section named "…", and copy its viral code to that newly created section. Another variant will simply append its code to the end of the last section.
The virus has a payload which activates on December 25th. On this day, the virus will attempt to :
- Erase the computer's CMOS information including date and time functions and the type of hard disk the computer uses.
- Erase disk sectors which includes all data on your drives, as well as data that resides on a network to which the infected computer is attached (mapped network drives).
- Flash the BIOS with garbage which if succeeds, could make it impossible to reboot the computer even from a floppy disk (similar payload of the CIH/Chernobyl virus).
In addition, the virus code also contains a poem that is not used in any way. Below is an extract:
".......
ALL YOU DO IS TALK ABOUT YOURSELF
I DON'T WANNA HEAR IT, COZ I KNOW NONE OF IT IS TRUE
I'M SICK AND TIRED OF ALL YOUR GODDAM LIES
LIES IN THE NAME OF GOD
WHEN ARE YOU GOING TO REALIZE THAT I DON'T WANT TO HEAR IT?!
........"
#### 2.3 Symptoms
Users infected with the W32/Kriz virus may notice strange systems behaviour including programs crashing and file size increasing. Infected users will also have the file WININIT.INI created in the Windows subdirectory. The payload of W32/Kriz results in significant loss of data from the hard drive, as well as the possible inability to startup or reboot the computer.
### 3.0 Possible Steps
**3.1 Prevention and Detection**
The virus can be contracted by users who downloaded software applications, such as screen savers or computer games, over the Internet and then install them on their personal computers. It can then be transmitted to many more people via email attachments or file sharing.
Therefore for those that already have an antivirus software running on their machine, it is advisable for them to regularly update their antivirus definition file/library so that the software could detect the presence of a new virus before any infections can occur. The list of known anti-virus vendors are as listed in MyCERT's website ([https://www.mycert.org.my/portal/articles-content?menu=4b05e0fb-afa1-408f-90ca-ea0edf4aca8b&id=b83f4c4d-f1e2-4a9d-ab55-6389ae1f6efc](https://www.mycert.org.my/portal/articles-content?menu=4b05e0fb-afa1-408f-90ca-ea0edf4aca8b&id=b83f4c4d-f1e2-4a9d-ab55-6389ae1f6efc
) ). Users that have not installed an antivirus software on their computer is advised to do so.
Run a virus scan on all downloadable files and software application before installing or executing them.
Do the same for all email attachments before opening or executing them even if it came from a known person/source. If in doubt, delete the email including those that are sent to the Trash folder.
As a precaution, configure your antivirus software so that it will do an **automatic** scan on all email attachments and downloadable files before being executed. Do remember that your computer cannot be infected by a virus by just opening an email. Infections only occur if the attachment that contains the virus is executed.
### 4.0 More Information
To obtain more information on this virus, please refer to the following site :
4.1 **Network Associates**
http://vil.nai.com/vil/content/v\_10255.htm
4.2 **Symantec Antivirus Research Center**
http://www.symantec.com/avcenter/venc/data/w32.kriz.html
4.3 **Data Fellows Computer Virus Information Pages**
http://www.europe.f-secure.com/v-descs/kriz.shtml
4.4 **SF Gate**
http://www.sfgate.com/cgi-bin/article.cgi?f=/chronicle/archive/1999/08/19/BU34839.DTL&type=printable