CyberGlossary

Malware

Resident Virus

Also known as: Memory-resident virus

Definition

A virus that installs itself in memory so it can run continuously and infect files or processes long after its host program has exited.

A resident virus loads its code into RAM during execution and remains active even after the program that introduced it has terminated. From memory, it can hook system calls, monitor file activity, and infect every executable or document that is opened, copied, or saved. This persistence makes resident viruses harder to remove because they can re-infect cleaned files immediately. They are typically Windows or DOS-era malware that integrate themselves into interrupts or system services. Defences include behaviour-based antivirus that watches process injection and memory hooks, exploit-protection in modern OSes, application allow-listing, and full system scans from a clean offline environment.

Examples

  • Randex and CMJ, classic memory-resident DOS viruses.
  • Magistr and Funlove that hooked Windows APIs to infect executables on access.

Related terms