Interpreted virus

Interpreted viruses are composed of source code that can be executed only by a particular application or service. Interpreted viruses have become very common because they are much easier to write and modify than other types of viruses. A relatively unskilled attacker can acquire an interpreted virus, review and modify its source code, and distribute it to others. There are often dozens of variants of a single interpreted virus, most with only trivial changes from the original. The two major types of interpreted viruses are macro viruses and scripting viruses.

Macro viruses are the most prevalent and successful type of virus. These viruses attach themselves to application documents, such as word processing files and spreadsheets, and use the application's macro programming language to execute and propagate. Macro viruses use the macro programming capabilities that many popular software packages, such as Microsoft Office, use to automate complex or repetitive tasks. These viruses tend to spread quickly because users frequently share documents from applications with macro capabilities. In addition, when a macro virus infection occurs, the virus infects the template that the program uses to create and open files. Once a template is infected, every document that is created or opened with that template is also infected. The Concept, Marker, and Melissa viruses are well-known examples of macro viruses.

Scripting viruses are very similar to macro viruses. The primary difference is that a macro virus is written in a language understood by a particular application, such as a word processor, whereas a scripting virus is written in a language understood by a service run by the OS. For example, the Windows Scripting Host feature on some Microsoft Windows systems can execute scripts written in VBScript. Examples of well-known scripting viruses are First and Love Stages.