What changed?
As DOS software spread, executable programs became another place where unwanted code could attach itself. Some threats also stayed active in memory after a program ran, complicating simple inspection.
How it spread / worked conceptually
Conceptually: a clean program’s structure is altered; when the program executes, other files may become exposed. This gallery does not show executable layouts or reproduction techniques.
Why it mattered
File infection expanded the number of potential carriers and made detection a recurring maintenance task. Memory-resident and stealth ideas challenged the assumption that a quick manual check was enough.
Representative historical examples
Michelangelo is remembered for the public attention around its March 6 trigger date. Polymorphic techniques changed a program’s visible pattern, making simple matching less reliable.
What defenders learned
Signature scanning became important, while defenders also learned that changing patterns require layered analysis.
What changed next?
The next major infection surface was not an executable program. It was the document.