Name: Win95.Evi Category: Viruses Description: Details Win95.Evil It is a dangerous nonmemory resident parasitic Windows95 virus. It searches for PE EXE files (Portable Executable), then writes itself to the end of the file. While infecting the virus increases the size of last file section, writes itself to there and modifies the PE header fields including program's start address. To access file search/read/write functions the virus scans Windows95 kernel, gets undocumented DOS_Call function address and then calls it with DOS INT 21h functions numbers. The virus has several lethal bugs and very often corrupts files while infecting them. It contains the ID-word: EVIL