Which component is used to decrypt the virus code after it has started executing, typically following a control takeover?

Which component is used to decrypt the virus code after it has started executing, typically following a control takeover?

• A. Decryptor routine
• B. Mutation engine
• C. Polymorphic viruses
• D. Encryption viruses

Answer: (A)

When a virus is packed or encrypted, the piece that actually makes the encrypted payload run is the decryptor routine. This small loader runs first after control is gained, decrypts the rest of the virus code in memory, and then transfers execution to the now-visible, decrypted payload. That’s exactly why this component is described as decrypting the virus code after it starts executing—the decryptor unpacks or unveils the hidden code so the payload can run normally. The other terms refer to obfuscation strategies rather than the specific decryption step. The mutation engine is the mechanism that mutates the virus to avoid detection, and polymorphic viruses use such mutations to alter their appearance over time. Encryption viruses describe malware that encrypts user data or payloads, not the loader that decrypts the virus itself.

When a virus is packed or encrypted, the piece that actually makes the encrypted payload run is the decryptor routine. This small loader runs first after control is gained, decrypts the rest of the virus code in memory, and then transfers execution to the now-visible, decrypted payload. That’s exactly why this component is described as decrypting the virus code after it starts executing—the decryptor unpacks or unveils the hidden code so the payload can run normally.

The other terms refer to obfuscation strategies rather than the specific decryption step. The mutation engine is the mechanism that mutates the virus to avoid detection, and polymorphic viruses use such mutations to alter their appearance over time. Encryption viruses describe malware that encrypts user data or payloads, not the loader that decrypts the virus itself.