PE_KRIZ.4029是一个驻留内存的多态型病毒，当运行时它将感染win32可执行文件（例如：.exe和.dll）。当一个染毒的程序执行时病毒首先感染KERNELL32.DLL并且在整个Windows进程中驻留内存。之后，每次Woindows 启动病毒立即驻留内存并感染所有WIN32可执行文件。

该病毒在感染之前首先检测下列文件名是否存在（大部分是反病毒软件），如果有下列文件存在则不进行感染。

- _AVP32.EXE

- _AVPM.EXE

- ALERTSVC.EXE

- AMON.EXE

- AVP32.EXE

- AVPM.EXE

- N32SCANW.EXE

- NAVAPSVC.EXE

- NAVAPW32.EXE

- NAVLU32.EXE

- NAVRUNR.EXE

- NAVWNT.EXE

- NOD32.EXE

- NPSSVC.EXE

- NSCHEDNT.EXE

- NSPLUGIN.EXE

- SCAN.EXE

- SMSS.EXE

该病毒具有相当的破坏性，当12月25日病毒被触发，它将毁坏CMOS数据，向染毒机器的所有文件写入垃圾数据并破坏Flash BIOS。该病毒使用秘密技术来加密它的代码，在解密以后，你会在病毒体中发现下面的文本：

=( [c] 1999 [t] )=

YOU CALL IT RELIGION, YOU'RE FULL OF SHIT

YOU NEVER KNEW, YOU NEVER DID, YOU NEVER WILL

YOU'RE SO FULL OF SHIT, I DON'T WANT TO HEAR IT

ALL YOU DO IS TALK ABOUT YOURSELF

I DON'T WANNA HEAR IT, COZ I KNOW NONE OF IT'S TRUE

I'M SICK AND TIRED OF ALL YOUR GODDAMN LIES

LIES IN THE NAME OF GOD

WHEN ARE YOU GOING TO REALIZE THAT I DON'T

WANT TO HEAR IT?!

I KNOW YOU'RE SO FULL OF SHIT, SO SHUT YOUR FUCKING MOUTH

YOU KEEP ON TALKING, TALKING EVERYDAY FIRST YOU'RE TELLING STORIES, THEN YOU'RE TELLING LIES

WHEN THE FUCK ARE YOU GOING TO REALIZE THAT I DON'T WANT TO HEAR IT!!

AH, SHUT THE FUCK UP...

该病毒还有一些变种，如PE_KRIZ.4050，PE_KRIZ.3740（圣诞CIH）等，危害程度都不小，在欢度圣诞之际，请大家还是谨慎为妙。