I was looking at the tripartite structure of a virus, and it seems to check to see if a computer is infected before infecting it with the virus. Would this be an attempt to use files that are already present to infect, instead of transferring another copy of the virus onto the machine?

5 Answers 5


The goal of most malware is to remain active as long as possible. The longer it can collect keystrokes, participate in DDoS attacks, redirect search results, send spam emails, shows popup ads, etc., the more profitable it is for the creator. To reach this goal, it has to be undetected.

If a piece of malware infects a machine twice, it may leave the machine in an undefined state, or cause conflicts. It may also eat up more resources than normal. This can lead to detection through a variety of operations:

  • Attempting to lock the same file twice, causing a crash.
  • Injecting into running processes twice, causing memory corruption and crashes.
  • Infecting the same file twice, causing it to be corrupted.
  • Attempting to install multiple hooks on the same APIs / objects / system messages, causing erratic or undefined behaviour.
  • Increased CPU, network and disk usage from the burden of having multiple copies installed.

The less resources used and the less disturbance caused, the less likely the user is to notice something is wrong. Once a user notices something isn't working properly, they'll try to fix it, which might result in the malware being removed. As such, it's better for the malware creator to prevent these problems and remain covert.

  • 19
    Anyone writing software that installs should really look to good viruses as paradigms of usability.
    – Mikey
    Commented Oct 2, 2012 at 17:11

The first Internet worm, back in 1988, killed off the Internet (for a little while only, of course) because it did not check properly for its presence before installing itself again. It included a heuristic method which did not work as the author believed it would. All the copies clogged the networks and choked the machines, which was hardly inconspicuous.

A virus will want to check for its presence before infecting for the same reasons: to avoid drowning its host under multiple copies of itself. To spread efficiently, the virus must not kill its host too fast (and the same applies to biological viruses, by the way).

There is nonetheless a subtlety. There are a few simplistic viruses who damage the files they infect, by writing themselves over whatever instructions were at that emplacement. Such a virus could write and rewrite itself over the same file with no additional ill effect. However, since the original file is damaged, it does not work properly anymore, which makes the virus less invisible, and may prompt the user to do some cleaning. Therefore, efficient viruses copy the instructions around in the infected files, so that they get executed anyway. The infected file is necessarily enlarged in the process. If the virus infects a file repeatedly, then the file might grow without any limit, finally filling up the hard disk, in true 1988 fashion.


It's partially a business reason rather than a technical reason. I was once reading a blog post that was detailing a sales pitch, and it was heavily stressed by the person selling access to infected machines (for the purposes of spam relaying, stealing credit card info, DDoS, etc) that he wouldn't load multiple binaries onto each bot.

The more individual infections a machine has, the more likely it is to be noticed by the user, and the more likely it'll be cleaned. It pays to fly under the radar.

  • 2
    I don't suppose you bookmarked/saved a copy of the page. For those of us without the time needed to troll the darknets something like that could be interesting reading. Commented Oct 2, 2012 at 12:43
  • @dan-neely Regrettably not, sorry. If I find it, I'll post it here, but it was a fair while ago.
    – OtisBoxcar
    Commented Oct 2, 2012 at 13:03
  • For the first part of your post, it makes more sense to me that he was advertising this as a business reason to demonstrate that the infection count was accurate. As in, 10 infections means 10 computers, where it could be interpreted that there could instead be 10 infections but only 5 bots.
    – SpellingD
    Commented Oct 2, 2012 at 14:44

I would add as well, in addition to other answers, that there can be more than just checking to see if I am infecting the machine twice.

I would, if in that field, check to make sure the machine isn't infected with OTHER stuff as well as MY stuff.

The more stuff that's installed, the more likely the machine will crash, run slow or something will cause notice to the owner.

Preemptive removal of competitors products, as well as verification of no prior version of my product, would help keep the system mine. As mentioned, the goal would be to keep the CPU "mine". That means lay low and don't attract notice.


The machine may become slow, to the point where it's unusable. For example if a virus continually sends out e-mails other programs would run slower and the network would become saturated and the internet would slow down.
If the virus is a file infector it would corrupt a file by infecting it too many times.

  • The user might also get a physical notice from his ISP about unreasonable email activity, which would be a suicide move for the virus.
    – Thomas
    Commented Oct 3, 2012 at 11:17

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .