1. When a user runs an infected program, the computer starts by copying the program from the disk, where it is stored and inactive, into RAM, where it can be executed.

2. The viral code begins running first, while the infected program is still quiescent.

3. The virus copies itself in a part of RAM separate from the program so that it can continue its work even after the user starts running other software.

4. Its initial work done, the virus passes control back to the infected program.

5. When the user runs a different program, the dormant virus begins running again.

6. It inserts a copy of itself into the previously uninfected software so that the cycle of virulence can repeat.