Name: Win95.Markj.98 Category: Viruses Description: Details Win95.Markj.983 This is a Windows 95 memory resident parasitic virus. When an infected file is executed, it copies itself to the cave in Windows kernel (VMM data), hooks IFS API and infects PE executable files that are opened. While infecting the virus creates new section named "MarkJ_I" at the end of the file, writes its code to there, and patches PE header with 46-bytes entry routine. When an infected file is executed, this entry routine takes control and passes it to virus main routine. The virus uses a trick to be executed in Ring0 to be able to intercept IFS API. It patches PE header so that main virus code it loaded into not used block of Windows VMM data at the address C0000000h. Windows95 does not protect this block, so it is possible to write to that area and moreover to load section of PE executable file, and the virus uses this feature of Windows95 security. This virus infects files with EXE extension only, and does not affect several anti-virus programs and utilities with names finished with letters: IN32, AN32, NT95, OT95, OL95, XD95, VP32, VW32, PW32, ETUP, TART, ORER, SCAN (SCAN, F-PROT95, AVP32, all SETUP, START, EXPLORER). The virus does not manifest itself in any way, it contains the text: Mark J written by Murkry/IkX Mark J (TNN Remix) - VicodinES /TNN /CB