Printer Friendly

Symantec Provides Tool to Detect and Remove Destructive W32.Kriz Virus; W32.Kriz Virus Attempts to Wipe Out Computer Systems on Christmas Day.

Business Editors/Technology Writers

CUPERTINO, Calif.--(BUSINESS WIRE)--Dec. 19, 2000

Symantec Corp. (Nasdaq:SYMC) today announced the availability of a tool that can be downloaded and run to detect and remove W32.Kriz. W32.Kriz is a destructive virus that renders the system inoperable on Christmas day by wiping out all hard drives and attempting to erase the BIOS, an essential set of computer instructions that is stored on a chip and provides communication between the operating system and the hardware.

Users should scan their system prior to December 25 and on Christmas Day. The current virus definitions will detect this virus either through LiveUpdate or by download from . For users not running an anti-virus program, visit the site to run an online scanning tool to detect the virus. If their system is infected, users can download the utility tool to remove the virus from their system.

W32.Kriz was first discovered over a year ago, but has not been widespread until recently. In a rare, but increasingly common occurrence, the virus infected several common computer worms including Happy99.worm and W32.hllw.bymer.worm, allowing the two to propagate rapidly as one destructive unit. If no action is taken, the Symantec AntiVirus Research Center (SARC) expects to see high numbers of damage reports from all parts of the world on December 25. The payload is very similar to the CIH virus, which triggered on April 26, 1999 and 2000 causing worldwide damage. The CIH virus was also circulating in the wild for more than a year before it caused major destruction.

"To be completely protected from the destructive W32.Kriz virus, users should scan their system prior to December 25 and on Christmas Day using the utility program available on the SARC Web site," said Carey Nachenberg, chief researcher at SARC. "Symantec specifically created this utility to detect and remove the W32.Kriz virus from infected systems, ensuring customers uninterrupted use of their systems throughout the holiday season. SARC researchers will be working throughout the holidays to analyze new viruses and to provide our customers with protection."

W32.Kriz Virus Characteristics

W32.Kriz is a Windows 9x/NT virus, which infects Portable Executable (PE) Windows files. The virus goes resident into memory, attempting to infect any files that are opened by the user or applications. Additionally, the virus modifies the KERNEL32.DLL file, a critical operating system file that enables the virus to spread throughout the system, and attempts to corrupt some PE files, requiring them to be replaced by known, clean backups or from the installation package.


On December 25th, the virus will attempt to flash the BIOS of the computer, preventing the computer from booting up properly and in most cases, requiring the user to replace the hardware. The virus will also begin overwriting files on all available drives including mapped network drives, floppy drives and RAM disks. The payload is very similar to W95.CIH virus.

Symantec AntiVirus Research Center

SARC is one of the industry's largest dedicated teams of virus experts. With offices located in the United States, Japan, Australia, and the Netherlands, the sun never sets on SARC. The center's mission is to provide swift, global responses to computer virus threats, proactively research and develop technologies that eliminate such threats, and educate the public on safe computing practices. As new computer viruses appear, SARC develops identification and detection for these viruses, and provides either a repair or delete operation, thus keeping users protected against the latest virus threats.

About Symantec

Symantec, a world leader in Internet security technology, provides a broad range of content and network security solutions to individuals and enterprises. The company is a leading provider of virus protection, risk management, Internet content and e-mail filtering, remote management and mobile code detection technologies to customers. Headquartered in Cupertino, Calif., Symantec has worldwide operations in more than 33 countries.

NOTE TO EDITORS: If you would like additional information on Symantec Corporation and its products, please view the Symantec Press Center at on Symantec's Web site. Brands and products referenced herein are the trademarks or registered trademarks of their respective holders. All prices noted are in US dollars and are valid only in the United States.
COPYRIGHT 2000 Business Wire
No portion of this article can be reproduced without the express written permission from the copyright holder.
Copyright 2000, Gale Group. All rights reserved. Gale Group is a Thomson Corporation Company.

Article Details
Printer friendly Cite/link Email Feedback
Publication:Business Wire
Geographic Code:1USA
Date:Dec 19, 2000
Previous Article:The Plastic Surgery Co. Completes First Round Financing For Transition to its New Business Model: ``Personal Image Centers''.
Next Article:Return Assured Partners With Dimac Direct; Industry Leading Direct Marketing Company Brings Banking and Merchant Partners To Return Assured.

Related Articles
Sophos Six-Month Summary Of Virus Activity.
Top Ten Viruses Reported To Sophos In July 2001.
Top ten viruses and hoaxes reported to Sophos in May 2002. (Security).
Windows 32 viruses rule the waves--Sophos. (Virus Notes).
Top Ten Viruses and Hoaxes in July 2002.
Klez worm most prolific virus of year. (Virus Notes).
Top ten viruses and hoaxes in November 2002, Sophos. (Virus Notes).
Winevar worm. (Virus Notes).
Avril Lavigne worm needn't be so complicated- sophos. (Virus Reports).
Top ten viruses reported to Sophos in February. (Virus Notes).

Terms of use | Privacy policy | Copyright © 2018 Farlex, Inc. | Feedback | For webmasters