Armored Viruses use special "tricks" designed to foil anti-virus researchers. Any anti-virus researcher who wants to find out how a virus works must follow the instruction codes in the virus. By using a variety of methods, virus writers can make this disassembly task quite a bit more difficult. This usually makes the virus larger as well.

Fast and Slow Infectors A fast infector infects any file accessed, not just run. A slow infector only infects files as they are being created or modified. The purpose of this type of infection is to ride on the back of anti-virus software to infect files as they are being checked. By its nature, anti-virus software (a scanner, in particular) opens each file on a disk being checked in order to determine if a virus is present

Multipartite Viruses have a dual personality. Some are file viruses that can infect system sectors; others are system sector infectors that can infect files. Multipartite viruses are particularly nasty because of the number of ways they can spread. Fortunately, a good one is hard to write and most up-to-date scans will detect and delete them.

Polymorphic Viruses change themselves with each infection. These viruses are more difficult to detect by scanning because each copy of the virus looks different than the other copies. There are even virus-writing toolkits available to help beginners make these viruses. Fortunately, this type of virus will be immediately detected by most of the existing scanners.

Stealth Viruses take over portions of the system to effectively hide the virus from casual (and not so casual) examination. In order to infect, a virus must change something like a system file or a particular program. This virus must be running in your memory to do its' damage, which makes it very hard for a scanning program to remove this virus while windows is running