The exceptions to this general pattern are the “ANTI,” “WDEF” type viruses.
ANTI does not install a new resource, but patches the CODE 1 resource to include itself as a sub-routine. The virus does not install in the system file. When an infected application is run, it installs itself in the Finder. The Finder then infects all subsequent applications.
WDEF installs itself in the Desktop file and travels from Desktop to Desktop whenever this file is opened. WDEF does not install in applications or system files. Rebuilding the desktop clears this virus.