Which component decrypts the virus code and decrypts it only after taking control of the computer?

Which component decrypts the virus code and decrypts it only after taking control of the computer?

• A. Mutation engine
• B. Polymorphic viruses
• C. Decryptor routine
• D. Encryption viruses

Answer: (C)

The key idea is that the malware uses a decryptor routine to reconstruct its real, harmful code at runtime after it has gained control of the system. On disk the payload may be stored in encrypted form to evade detection, and when the virus runs, this decryptor decrypts the payload in memory and then transfers control to it so the malicious actions execute. The decryptor is the specific component that performs the decryption step; other parts like a mutation engine or the concept of polymorphic behavior relate to how the code changes between infections, but they do not perform the actual decryption at execution.

The key idea is that the malware uses a decryptor routine to reconstruct its real, harmful code at runtime after it has gained control of the system. On disk the payload may be stored in encrypted form to evade detection, and when the virus runs, this decryptor decrypts the payload in memory and then transfers control to it so the malicious actions execute. The decryptor is the specific component that performs the decryption step; other parts like a mutation engine or the concept of polymorphic behavior relate to how the code changes between infections, but they do not perform the actual decryption at execution.