VIRUS types

• ARMORED virus is one that uses special tricks to make tracing,disassembling and understanding of its code more difficult.  

EX.A good example is the Whale virus

• CAVITY VIRUS is one which overwrites a part of the host file that is filled with a constant (usually nulls), without increasing the length of the file, but preserving its functionality. 

The Lehigh virus was an early example of a cavity virus.

• COMPANION virus is one that, instead of modifying an existing file,creates a new program which is executed instead of the intended program.

 On exit, the new program executes the original program so that things appear normal.  On PCs this has usually been accomplished by creating an infected .COM file with the same name as an existing .EXE file. Integrity checking anti virus software that only looks for modifications in existing files will fail to detect such viruses.

Nimantha Welaratne

FB DOC