The virus infects files in two ways depending on the file's
structure. If the last section of the file is relocations
".reloc" section, the virus just overwrites it and erases
relocation info in the PE header. Otherwise the virus adds one
new section to the end of the file and writes its code to there.
To get control when infected file is run the virus also uses two
ways: it either modifies the program's startup address, or
patches the program's code with JMP_Virus instruction. In latter
case the virus does not receive control immediately when an
infected program is run, but only in case patched program's
branch gets control.
To install its hooker into the Ring0 (VxD) Windows memory the
virus uses the trick similar to "Win95.MarkJ" virus. It patches
the PE sections so, that Windows95 loads virus code into the VMM
Ring0 area instead of standard application's memory.
The virus does not manifest itself in any way. It contains the
[Analysis: Eugene Kaspersky; KL; Last modified: March 2001]