To avoid being detected by emulation, some viruses rewrite themselves completely each time they are to infect new executables. Viruses that use this technique are said to be metamorphic. To enable metamorphism, a metamorphic engine is needed. A metamorphic virus is usually very large and complex. For example, W32/Simile consisted of over 14000 lines of assembly code, 90% of it part of the metamorphic engine.

got feedback?

got feedback?

Any feedback you provide is sent to the owner of this FAQ for possible incorporation and shown publically as well.

by uid1307457
last modified: 2009-04-27 18:03:53