{"id":839,"date":"2013-02-28T22:28:25","date_gmt":"2013-03-01T06:28:25","guid":{"rendered":"http:\/\/e-olio.com\/cknow\/cms\/?p=839"},"modified":"2013-04-16T12:21:57","modified_gmt":"2013-04-16T19:21:57","slug":"fast-and-slow-infectors","status":"publish","type":"post","link":"https:\/\/www.cknow.com\/cms\/vtutor\/fast-and-slow-infectors.html","title":{"rendered":"Fast and Slow Infectors"},"content":{"rendered":"

A fast infector infects any file accessed, not just run. A slow infector only infects files as they are being created or modified.<\/strong><\/p>\n<\/div>The term fast<\/em><\/strong> or slow<\/em><\/strong> when dealing with viruses pertains to how often and under what circumstances they spread the infection.<\/p>\n

Typically, a virus will load itself into memory when an infected program is run. It sits there and waits for other programs to be run and infects them at that time.<\/p>\n

Fast:<\/strong> A fast infector infects programs not just when they are run, but also when they are simply accessed. The purpose of this type of infection is to ride on the back of anti-virus software to infect files as they are being checked. By its nature, anti-virus software (a scanner, in particular) opens each file on a disk being checked in order to determine if a virus is present. A fast infector that has not been found in memory before the scanning starts will spread itself quickly throughout the disk.<\/p>\n

Slow:<\/strong> A slow infector does just the opposite. A slow infector will only infect files when they are created or modified. Its purpose is to attempt to defeat integrity checking software by piggybacking on top of the process which legitimately changes a file. Because the user knows the file is being changed, they will be less likely to suspect the changes also represent an infection. By its nature (and because executable code is not usually changed) a slow infector does not spread rapidly and if the integrity checker has a scanning component it will likely be caught. Also, an integrity checker that is run on a computer booted from a known-clean floppy disk will be able to defeat a slow infector.<\/p>\n

Summary<\/h4>\n