These objectives are proven in Table 3-2, along with methods each aim can be addressed. Unfortunately, many of those behaviors are completely normal and may otherwise go undetected. For instance, one aim is modifying the file listing; many normal programs create recordsdata, delete files, and write to storage media. Thus, there are not any key signals that point to the presence of a virus. Most viruses connect to packages which are stored on media such as disks.

Trivially, assume a virus author has 100 bytes of code and 50 bytes of information. To make two virus instances completely different, the author might distribute the primary model as a hundred bytes of code followed by all 50 bytes of data. A second model might be ninety nine bytes of code, a leap instruction, 50 bytes of knowledge, and the last byte of code. Other versions are ninety eight code bytes jumping to the last two, ninety seven and three, and so forth. Just by transferring pieces across the virus author can create enough different appearances to fool easy virus scanners.