A POLYMORPHIC virus is one which produces varied (yet fully operational) copies of itself, in the hope that virus scanners (see D1) will not be able to detect all instances of the virus.

One method to evade signature-driven virus scanners is self-encryption with a variable key; however these viruses (e.g. Cascade) are not termed “polymorphic,” as their decryption code is always the same and thus can be used as a virus signature even by the simplest, signature-driven virus scanners (unless another virus or program uses the identical decryption routine).

One method to make a polymorphic virus is to choose among a variety of different encryption schemes requiring different decryption routines: only one of these routines would be plainly visible in any instance of the virus (e.g. the Whale virus). A signature-driven virus scanner would have to exploit several signatures (one for each possible encryption method) to reliably identify a virus of this kind.

A more sophisticated polymorphic virus (e.g. V2P6) will vary the sequence of instructions in its copies by interspersing it with “noise” instructions (e.g. a No Operation instruction, or an instruction to load a currently unused register with an arbitrary value), by interchanging mutually independent instructions, or even by using various instruction sequences with identical net effects (e.g. Subtract A from A, and Move 0 to A). A simple-minded, signature-based virus scanner would not be able to reliably identify this sort of virus; rather, a sophisticated “scanning engine” has to be constructed
after thorough research into the particular virus.

The most sophisticated form of polymorphism discovered so far is the MtE “Mutation Engine” written by the Bulgarian virus writer who calls himself the “Dark Avenger”. It comes in the form of an object module. Any virus can be made polymorphic by adding certain calls to the assembler source code and linking to the mutation-engine and random-number-generator modules.

The advent of polymorphic viruses has rendered virus-scanning an ever more difficult and expensive endeavor; adding more and more search strings to simple scanners will not adequately deal with these
viruses.