They restore the resource when they are actived - so the application appears to function normally until the virus is removed. This kind of behaivour is known as symbiotic. The general method of activation of the MDEF is to hijack one of the menus inside the infected app to use the viral MDEF as their menu-drawing procedure, instead of the system default one. If your system is infected, then every application you launch will also be infected. Some later strains attempt to infect apps in the same folder as their host, even without the system being infected.
Some strains infect the system file with an 'INIT' instead of creating an extension file for it.