What is a polymorphic virus? And how to avoid them

Every year, millions of people fall victim to computer viruses. Sometimes, removing these is as simple as running a quick virus scan, but with more than 200,000 new malware variants every year, it’s increasingly difficult for antivirus providers to keep up. Further, around 97 percent of all viruses have polymorphic characteristics, meaning they’re even harder to detect and fully remove from your device.

This sounds very scary, but knowing your enemy is half the battle. Below, we’ll discuss how polymorphic viruses differ from classic malware, what this means for victims, and, most importantly, what to do if your system is compromised. Finally, we’ll provide some tips to reduce the chance of future infection.

A brief overview of “traditional” viruses

The earliest computer viruses were fairly straightforward, relatively speaking. Once a device was infected, the malware would do the exact same thing every time. For instance, any files a virus created would always have the same names, and stolen data would always be sent to the same servers.

This predictability meant that over the years, it became easier and easier to identify which strain of malware compromised your system. This was bad news for hackers. Antivirus providers could simply monitor which changes occurred after infection and create a reliable, automated process for blocking or reversing them.

How are polymorphic viruses different?

In a bid to stay one step ahead, hackers began creating viruses that behaved differently for each infected user. Initially, they could avoid detection by randomly generating folder names and changing the location of key files, but eventually, that was no longer enough. As soon as the virus became widespread, antivirus software could identify a signature (whether it’s a characteristic pattern, piece of code, behavior, or hash), confirm what was happening, and begin the removal process.

Polymorphism became the new standard. In simple terms, malware can change its code or structure, making it significantly more difficult to detect patterns and say which malware family you’re dealing with. While this type of software is undoubtedly malicious, the lack of a known signature meant that most antivirus apps didn’t see a problem. Users were allowed to install malware and often didn’t realize there was a problem until it was too late.

Removing infections is now far more complicated. Because these viruses don’t follow a set pattern, it’s extremely difficult to tell what they’re capable of until you’ve analyzed many compromised systems. Additionally, the same strain of ransomware can use different encryption keys, making it much more difficult to reverse-engineer a solution that works for everyone affected.

How to remove a polymorphic virus

It is near-impossible to get rid of polymorphic malware by yourself. Luckily, you’re not alone. Most major antivirus providers now use more advanced detection methods, looking for similarities between suspicious programs instead of an outright match. Some even employ machine-learning tools to quickly establish whether a file will likely contain malware.

Follow these instructions to remove polymorphic malware and return your PC to normal:

1. First, sign up for a reputable antivirus service. We recommend Norton 360 – it supports a wide range of operating systems, boasts an impressive detection rate, and has been actively combatting polymorphism for over a decade.
2. Install the software, download the latest updates, and perform a full system scan. This will take some time, so be prepared not to use the computer for a while. If this isn’t feasible, then you may want to leave the scan running overnight.
3. Once the scan is complete, you’ll be alerted to any malicious programs or files that are detected. There’ll almost always be a large button saying “Remove”, “Delete”, or “Quarantine” – click this. At this point, you may be asked to restart your PC. Once you do, the virus should be completely gone from your system, but it’s a good idea to run another scan just to be sure.
4. Next is the cleanup phase. Change any compromised passwords, schedule periodic malware scans, and reactivate any security tools that may have been turned off, such as your firewall, User Account Control alerts, or Windows Defender.
5. If you’re confident that you have a virus but it wasn’t detected by your chosen antivirus app, things become more complicated. Most providers will offer a refund in these circumstances, so you could always try another. Alternatively, you can use system restore to return your device to a time before the infection occurred. In severe cases, your best bet may be to reinstall the operating system entirely (though this is the nuclear option and will cause you to lose all of your files).

Five simple steps to avoiding future malware infections

Instead of focusing on the best way to remove viruses, avoiding getting them in the first place is best. There are a million different ways your system could be infected, but by following the steps below, you can reduce your exposure and give attackers fewer ways to breach your defenses:

1. Start by installing antivirus software with real-time protection. This should flag many shady websites and downloads, preventing them from becoming problematic. Ensure automatic updates are enabled for maximum protection and the software can scan your system regularly.
2. Use a Virtual Private Network (VPN) whenever on a network you don’t own. These encrypt your data, preventing hackers from monitoring your activities, hijacking your browser, or forcing you to download malicious files without your consent.
3. Only download files from trustworthy websites. No reputable site is intentionally going to host malware-ridden files. If a file seems to be available only from a single sketchy site or a lone forum user, it’s most likely not legitimate.
4. Never allow someone to remotely connect to your PC, even if they claim to be offering tech support. Similarly, we’d advise against running commands unless you’re sure of what they do. It’s far too easy for a convincing scammer to have you compromise your own security and grant them free rein to cause chaos.
5. Finally, educate yourself on the most common methods of attack. This will let you know what to look out for, warning signs that something may not be right, and what to do if you are compromised. Remember: criminals are always refining their techniques, and as such, you’ll have to check back periodically to stay up-to-date.

Getting rid of a polymorphic virus: Frequently Asked Questions