Viruses that surround

• Still runs the original program but has control after original program executes as well as before.

• Can be sneakier than appended virus

  • infect “dir” command for instance.
  • When “dir” lists our dir.com in a directory the virus portion could alter the file listing to display dir.com with its normal file size. Making it hard to detect the infection.