A Direct Action Virus (also called a non-resident virus) is a type of file-infecting computer virus that attaches itself to executable files (typically .COM or .EXE).
When an infected program is run, the virus immediately:
- Executes its code
- Searches for other suitable files (usually in the current directory or the system
PATH) - Infects those files
- Returns control to the original host program
Unlike resident viruses, it does not stay active in memory after the host program finishes. It performs its infection routine only while the infected file is running and then exits.
Classic example: the Vienna virus (1987–1988).
How Direct Action Viruses Work
- They append or prepend their code to executable files.
- Infection happens only when the user runs an already-infected program.
- They do not install themselves permanently in RAM.
- Most early examples had limited payloads (some damaged files, others simply replicated).
They are generally considered less sophisticated and easier to remove than memory-resident viruses.
History and Evolution
Direct-action (non-resident) file viruses appeared in the late 1980s during the DOS era.
- One of the earliest well-known examples is the Vienna virus.
- They were common in the floppy-disk era because they did not need to remain in memory.
- Over time, most successful viruses became resident (memory-resident) because that method allowed continuous infection of newly executed programs.
Boot-sector viruses (Stoned, Michelangelo, etc.) and later mass-mailing macro viruses/worms (Melissa, ILOVEYOU) belong to completely different categories and should not be classified as Direct Action Viruses.
Accurate Examples of Direct Action Viruses
| Virus | Type | Notes |
|---|---|---|
| Vienna | Classic Direct Action | One of the first to be defeated by an antivirus |
| Early Cascade variants | File infector (sometimes classified as direct action) | Displayed falling characters |
| Some simple .COM/.EXE infectors | Non-resident | Limited spread, easy cleanup |
Incorrectly listed in the original text:
- Stoned → Boot-sector virus (resident)
- Jerusalem → Memory-resident file virus
- Michelangelo → Boot-sector virus (Stoned variant), activates March 6
- CIH / Chernobyl → Windows PE file infector with destructive payload (April 26)
- Melissa → Macro virus + mass-mailing worm (1999)
- ILOVEYOU → VBS mass-mailing worm (2000)
- Code Red → Network worm (not a virus)
Symptoms of Infection
Because these viruses only run when an infected executable is launched, symptoms are usually mild compared with modern malware:
- Unexpected growth in size of
.COMor.EXEfiles - Occasional file corruption
- Slow performance only while the infected program is running
- Antivirus alerts when scanning executables
They rarely cause the dramatic system-wide destruction described in the original article.
How They Spread
Primarily through:
- Sharing infected executable files (floppy disks in the past, USB drives or downloads today)
- Running programs from untrusted sources
They do not typically spread via email attachments in the modern sense (that behavior belongs to macro viruses and worms).
Prevention and Removal
Prevention
- Keep antivirus/anti-malware software updated
- Avoid running unknown
.EXEor.COMfiles - Enable real-time protection
- Keep the operating system patched
- Use strong user account controls
Removal
- Run a full system scan with an up-to-date antivirus
- In most cases, the antivirus can clean or quarantine the infected files
- Because the virus is non-resident, a simple reboot + scan is often sufficient
- Restore clean copies of affected programs from backups if needed
Direct Action vs. Other Virus Types
| Feature | Direct Action (Non-resident) | Resident Virus | Boot Sector Virus | Macro / Mass-mailing |
|---|---|---|---|---|
| Stays in memory | No | Yes | Yes | Varies |
| Infection timing | Only when host runs | Continuously | On boot | When document opens |
| Typical targets | .COM / .EXE files | Running programs | Boot sector / MBR | Office documents |
| Difficulty of removal | Usually easy | Harder | Moderate | Moderate |
| Classic example | Vienna | Jerusalem | Stoned / Michelangelo | Melissa |
Current Relevance
True classic Direct Action Viruses are rare today. Modern threats have largely moved to:
- Fileless malware
- Ransomware
- Trojans
- Worms
- Polymorphic and metamorphic engines
The classification is still taught in cybersecurity courses because it helps explain the fundamental difference between non-resident and resident infection strategies.
