32-bit file viruses

Previous file viruses were made for 16-bit program files used by MS-DOS. The 32-bit versions of Windows, such as Windows 95, 98 and NT, use a different and more complex format for the program files. Traditional files viruses cannot infect these files. A new group of file viruses emerged as the 32-bit operating systems became more popular. These viruses are by nature similar to the previous file viruses with the exception that they can infect the new file format and work in 32-bit environments. This category is also called PE-viruses, because the new executable file format’s name is PE (portable executable). The new format is also used by many other modules in the system, such as DLLs, system drivers etc. Some viruses infect these modules as well, but most stick to program files with the EXE extension.

The number of known 32-bit file viruses is rather small. The most probable reason is that the new file format is complex and making a virus that infects these files is significantly harder than making other types of viruses.

This type of virus has become widespread mainly among home users who tend to exchange program files more frequently than business users.

Provided courtesy by F-Secure Corporation.