Computer Viruses and Malware

Non-resident viruses operate in two distinct phases: a finder module searches for files to infect, and a replication module handles the actual infection. Unlike resident viruses that stay in memory, non-resident viruses don't remain active after infection. Trojans and worms are fundamentally different - Trojans disguise themselves as legitimate software, while worms spread independently without needing a host file.

Cavity viruses infect executable files by inserting their code into unused spaces (cavities) within the file, which means they don't change the file's overall size. This stealth technique helps avoid detection based on file size changes. The other options are either made-up terms or unrelated attacks (XSS Worm is a web vulnerability, not a file virus type).

Bait files (also called goat files) are dummy files created by antivirus researchers to attract and analyze virus infections. These files help study virus behavior without risking important data. The other terms are not standard antivirus terminology - trap files might seem plausible but bait files is the correct industry term.

A virus signature is a unique byte pattern or sequence of code that antivirus software uses to identify specific viruses. It's like a fingerprint that allows detection of known malware.

A polymorphic virus changes its code (decryption module) on each infection to avoid detection by signature-based antivirus. Option B correctly identifies that the decryption module is modified, while A incorrectly states the encryption module changes.

CiaDoor is a notorious virus/malware that specifically disables critical system tools including System Restore, Task Manager, and Command Prompt to prevent users from removing it. W32/Similie and Chernobyl are different types of malware, and XORing is an encryption technique.