I was reading about Metamorphic & polymorphic viruses ..

to what i understood ; they both uses mutation engines to avoid detection by anti-viruses, as the polymorphic encrypts\decrypts its code , and the metamorphic generates a logical equivalent code.

According to what i know , viruses are parasitic male-ware. i.e. it needs a host to produce copies of itself and cannot act independently like worms .

So my question is , during the virus's typical life cycle (infection - duplications- activating payload- etc ) , where is the mutation engine in all this ? And when a virus moves from its host to another PC what happens to the engine ? And what happens at the next host in the first cycle , how can it achieve its mutation ?

2 Answers 2


The mutation engine is contained in the virus body.

It is just another module of the virus. Viruses typically have a file scanning module, an infection module, a mutation module, a payload module and many others. On infection, the mutation module is used to mutate all of its modules and pass them to the infected host.

Mutation engines are mostly targeted by antivirus engines because they have typical behavior and are often used for multiple families of infector malware. They are targeted also because they are weekly mutated. That is because "mutating" the "mutator" can lead to bad "monster mutations" :)


I think things become a little more complex...As today every hosts hold sufficiently memory to let a big, very big virus install without making a big print on host's memory: While a server could work normally with 24Gb memory how mutch could use a virus before it will be statistically visible?

There is now enough space to hold a full C compiler, analytic engines and lot of packages, like upgrade engines (same as apt-get could do in Debian, for sample). Installed virus may now be upgraded to follow anti-virus developments and have appropriate reaction...

I think, (but don't have any proof ;), that new generation of polymorphic viruses could grown and become self-versonized by himself... (and maybe through some hidden repositories for authoritative upgrades).

Nota: Bandwidth are growing too, so with the help of a little of stegano (another package in virus installation) making upgrade could be strongly hidden too.

But... I'm (a little) paranoid and have a lot of imagination.

  • I think the scenario ur speaking about is closer to worms than viruses ....viruses are parasitic malware so on the same host you will find a copy in each infected file , so they cant start updating or they will be detected because the unusual traffic (imaging all the infected files are updating on a host)
    – HSN
    Commented Dec 30, 2012 at 11:33
  • 1
    Maintening registers like dns and use local connections whenever exists, clearly yes! Don't think hackers are stupids! If a good programmer team could build impressive so called intuitive OS, why did you think a good pirate team could not invent new generation of intuitive and evolutive viruses? (At all, a virus don't need to infect all files nor many, depending on how, why and what, only 1 file by host is sufficient) Commented Dec 30, 2012 at 11:55

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .