>and were meant to show off the skills of the writer I believe that is just nostalgia. I have reverse engineered a few and almost all of them are badly designe

>and were meant to show off the skills of the writer I believe that is just nostalgia. I have reverse engineered a few and almost all of them are badly designed, make assumptions about the state of the OS/datastructures (that turn out to be false sometimes, causing them to crash) and do things that are trivial for any intermediate low-level programmer. Commonly - modify command.com or other executables to load itself when executed (some tricky viruses even removed their modifications from those EXEs once they were memory resident) , plop some executable code in the bootsector, hook into some i/o interrupt, install itself as a TSR, etc Modern malware is equally buggy, but will do things that are much much more sophisticated - due to the arms race between antivirus folks and malware writers. Especially the techniques they use to thwart being live-debugged, or identified as malware are pretty ingenious. A lot of DRM tech. (securom comes to mind) does similar crazy stuff as well - in addition to causing system instability.