All viruses operate in a common fashion: an infected application is run on a clean drive, and the virus installs an INIT in the system file. It may also do other things and install the INIT in other files, but since the system runs behind all applications, it will always install there. On the next startup, the INIT loads into memory and will begin infecting applications. Some viruses require that the program be run, others do not. The virus will alter the application’s Code 0 resource, (the jump table, that tells the program what to load). It will install its own code segment, and then patch the jump table so that its segment runs first. The viral code segment must contain a copy of the original jump table so that the real program can execute.
