An appending virus is a type of virus that adds its code to the end of the file of a host program. Its goal is not to destroy the host program, but to slightly modify it so that it will hold the virus code while continuing to operate.
The appending virus copies the first bytes of its code to a safe location and then adds a jump to its code at the beginning of the program that is to run just before the host takes control. Contrary to an overwriting virus, this virus does not permanently destroy any part of the host program, which makes it more difficult to detect the infection.
The appending virus copies the first bytes of its code to a safe location and then adds a jump to its code at the beginning of the program that is to run just before the host takes control. Contrary to an overwriting virus, this virus does not permanently destroy any part of the host program, which makes it more difficult to detect the infection.
An appending virus takes a lot of steps to attach to a host program. Technically, the virus searches for a file and then calculates its delta offset to determine the exact file size. Then it takes the file attributes and saves them to restore them later to make the file appear to be unedited. It then checks the file to determine whether it is already infected. If not infected, the appending virus attaches itself to the end of the program file. After it has lodged itself into the host, the virus restores all the attributes the file had before it was modified so that no traces of modification appear.
Anti-virus programs sometimes have trouble detecting a well-written appending virus. Because it encrypts itself, the encryption is different for all iterations of the virus. The scanner cannot directly detect the virus, but can still detect the decrypting module of the virus and flag it as malicious. The only thing similar on all the different instances of the virus is the decrypting module. In this case, it is always useful to have more than one anti-virus program scanning the system in the hope that one program will detect what others have missed.
Anti-virus programs sometimes have trouble detecting a well-written appending virus. Because it encrypts itself, the encryption is different for all iterations of the virus. The scanner cannot directly detect the virus, but can still detect the decrypting module of the virus and flag it as malicious. The only thing similar on all the different instances of the virus is the decrypting module. In this case, it is always useful to have more than one anti-virus program scanning the system in the hope that one program will detect what others have missed.
0 Comments