Name: Win95.Chimera.154 Category: Viruses Description: Details Win95.Chimera.1542 This is a dangerous Win9x parasitic stealth virus. The virus switches its process to Windows kernel mode (Ring3->Ring0), hooks file access functions (IFS API) and stays in the system memory as Win9x driver (VxD). The virus then infects Win32 applications (PE EXE files) that are accessed. While infecting a file, the virus writes itself to the end of the file and modifies necessary PE header fields. The virus has a bug, and in some cases, infected applications cause a standard Windows message to appear about an error in an application. The virus infects not only files with the .EXE filename extension, but any PE EXE file. As a result, many DLL, DRV and other PE files are infected (especially in the Windows system directory), as a result, the infected system in many cases cannot restart and halts with an error message. The virus contains the following text string: Chimera The infected files also have an "infected ID" text string in their DOS stub: krad