See Figure 4 . When the virus initially loads, a small, efficient decryption routine converts the encrypted code into plain text instructions. The decrypted virus then resides in memory ready to be executed. Encryption methods between viruses range from simple to complex. See Figure 5 for an example of instruction decryption code.
Some viruses use several levels of encryption to thwart disassembly attempts.
Often, the decryption routine itself is encrypted. Now that I've shown you how tricky viruses have become, don't give up hope. Keeping them off your computer is actually easy with a little preparation. Show me a person who was devastated by a computer virus, and I'll show you a person who was not prepared. First, concerning susceptibility, a user fits into one of three risk groups, with Risk Group 1 being the most susceptible and Risk Group 3 being the least.