Kriz virus makes return appearance

Kriz, a year-old computer virus, may be coming back for Christmas this year, thanks to its ability to piggyback other viruses.

The Kriz virus, also known as the W32.Kriz, is based on the CIH virus, which damaged computers worldwide when it was triggered on 26 April 1998. Antivirus software maker Symantec Tuesday warned users to scan their computers before Christmas and released a free tool to scan for the virus and remove it.

"Worms by their nature propagate pretty quickly," said Marian Merritt, group product manager for Symantec. "And when they get on a computer with Kriz, they start spreading that."

Symantec and other antivirus software already scan for the virus in their stand-alone programs.

The Kriz virus spreads to a computer when the user opens up an infected file, changing the basic program that runs the operating system, known as the kernel. The virus also infects other programs on the computer's hard drive and any mapped drives, leaving open the possibility that the virus could travel across company networks.

"Remember," said Symantec's Merritt. "It may have spread itself to all your executables, but you are only a carrier of the virus. The real payload hits on 25 December."

When the virus triggers, it overwrites all files on the computer and then attempts to erase the software foundation of the PC, known as the basic input-output system, or BIOS. While the BIOS attack only occasionally works, the other attacks can be extremely destructive. Symantec rival, Trend Micro believes the virus would not spread very far, but warns that its ability to combine with other viruses could change that.

Both Trend Micro and Symantec reported that the virus has infected two other worms: Happy99.worm -- also known as W32.Ska -- and W32.hllw.bymer.worm.

"Kriz is a destructive virus, but a really slow infector," said Joe Hartmann, antivirus researcher for Trend Micro. "Yet, it's now infected a mass-mailer, so now you have a destructive virus that's also a mass mailer." In the past 24 hours, Kriz ranked number eight on Trend's Worldwide Virus Tracking Center in terms of how many files the virus had infected. The tracking centre is a real-time database of the types of viruses found by the Trend's online House Call scanner.

In North America, the virus ranked number sixfor file infected. Despite that, the virus has not spread very widely yet, and is known to have infected about 50 computers in the last 24 hours. Because the tracking center only tracks viruses that have infected users of Trend Micro's online service, the actual number could be much greater.

Historians take heed, however.

The Kriz virus is essentially a copy of the CIH virus, which was created in 1997 by Cheng Ing-Hau of Taiwan. CIH fizzled in its first year, and a variant that struck every month died out quickly. However, the annual variant did significantly more damage when it was triggered in April 1998.

Find out how to deal with the Kriz worm.

Take me to the Virus Workshop

Take me to ZDNet Enterprise

Have your say instantly, and see what others have said. Click on the TalkBack button and go to the ZDNet News forum.

Let the editors know what you think in the Mailroom. And read what others have said.