Appending Virus

Why Trust Techopedia

What Does Appending Virus Mean?

An appending virus is a type of virus that adds its code to the end of the file of a host program. Its goal is not to destroy the host program, but to slightly modify it so that it will hold the virus code while continuing to operate.


The appending virus copies the first bytes of its code to a safe location and then adds a jump to its code at the beginning of the program that is to run just before the host takes control. Contrary to an overwriting virus, this virus does not permanently destroy any part of the host program, which makes it more difficult to detect the infection.

Techopedia Explains Appending Virus

An appending virus takes a lot of steps to attach to a host program. Technically, the virus searches for a file and then calculates its delta offset to determine the exact file size. Then it takes the file attributes and saves them to restore them later to make the file appear to be unedited. It then checks the file to determine whether it is already infected. If not infected, the appending virus attaches itself to the end of the program file. After it has lodged itself into the host, the virus restores all the attributes the file had before it was modified so that no traces of modification appear.

Anti-virus programs sometimes have trouble detecting a well-written appending virus. Because it encrypts itself, the encryption is different for all iterations of the virus. The scanner cannot directly detect the virus, but can still detect the decrypting module of the virus and flag it as malicious. The only thing similar on all the different instances of the virus is the decrypting module. In this case, it is always useful to have more than one anti-virus program scanning the system in the hope that one program will detect what others have missed.


Related Terms

Margaret Rouse

Margaret jest nagradzaną technical writerką, nauczycielką i wykładowczynią. Jest znana z tego, że potrafi w prostych słowach pzybliżyć złożone pojęcia techniczne słuchaczom ze świata biznesu. Od dwudziestu lat jej definicje pojęć z dziedziny IT są publikowane przez Que w encyklopedii terminów technologicznych, a także cytowane w artykułach ukazujących się w New York Times, w magazynie Time, USA Today, ZDNet, a także w magazynach PC i Discovery. Margaret dołączyła do zespołu Techopedii w roku 2011. Margaret lubi pomagać znaleźć wspólny język specjalistom ze świata biznesu i IT. W swojej pracy, jak sama mówi, buduje mosty między tymi dwiema domenami, w ten…