W32/Kriz Virus Scanner and Remover

W32/Kriz is a Windows file virus that will infect PE files under Microsoft Win9x and WinNT 4.0 platforms. This virus will wake up or get activated on 25th of December [Xmas day] and it will damage the motherboard and the hard drive. The damage caused could be extreme and expensive.

When the virus is first run, it patches the critical operating system file KERNEL32.DLL and stores it in the name of KRIZED.TT6. On the next startup it replaces original KERNEL32.DLL file with KRIZED.TT6. The variants of Kriz will use different name to patch KERNEL32.DLL. Then it become memory resident and infects all accessed Windows Portable Executable files.

The payload of W32/Kriz is stolen from deadly W95/CIH virus. The computer motherboards manufactured in the last few years store their BIOS on a flash ROM chip which are rewritable. W32/Kriz virus directly attacks the code stored in the flash ROM chip and makes the computer unbootable.

Options: ￭ /SCAN - Scans the system for I-Worm/Nimda ￭ /REPAIR - Use this option to CLEAN the worm ￭ /SCAN - Scan all files ￭ /BAK - Create backup copy before cleaning ￭ /NOSUB - Sub Directories OFF ￭ /REPORT - Generates report - C:/VIRUSCAN.RPT ￭ /HELP - Detailed help to clean the I-Worm/Nimda worm