Computer virus

A computer virus is defined by its ability to reproduce by modifying or attaching itself to other executable content. It generally contains a replication mechanism, a condition that determines when it acts, and an optional payload that performs a harmful or merely disruptive operation. The infected host may be an executable program, a document containing macros, a script, or—in older systems—a boot sector.

When a user opens the host or the operating system otherwise runs it, the virus executes and seeks additional targets. Some viruses remain dormant until a date, event, or system condition occurs; others replicate immediately. A virus can therefore be present without obvious symptoms, while visible effects such as altered files, unusual messages, or crashes are only possible consequences rather than defining features.¹

Viruses are classified chiefly by the locations they infect and the methods they use to remain active. File-infecting viruses append or insert code into executable files; boot-sector viruses target startup records; macro viruses exploit document automation; and script viruses use interpreters such as those for JavaScript or command shells.¹

Removable media, shared folders, email attachments, downloads, pirated software, and compromised websites have all served as transmission routes. A virus may use stealth techniques such as altered file sizes, encrypted bodies, or polymorphism, which changes its apparent code between infections. Modern security practice usually groups viruses with the broader category of malware, even though many contemporary threats—especially worms, trojans, and ransomware—do not meet the strict definition of a virus.

Computer viruses became a practical security concern as personal computers, bulletin-board systems, and removable disks connected previously separate users. The Brain virus, released in 1986, is commonly identified as an early PC boot-sector virus, while the 1988 Morris worm demonstrated how rapidly self-propagating code could affect networked Unix systems; technically, the worm was not a virus because it did not require a host file.²

Later outbreaks moved through office documents, email address books, and network shares, making social engineering as significant as programming technique. Effects have ranged from nuisance messages and damaged files to business interruption, recovery costs, and loss of trust. The distinction between virus and other malware remains useful for describing propagation, but incident responders generally prioritize the behavior and consequences of the entire malicious program.

Many viruses are designed to preserve the host program’s ordinary behavior, because obvious damage can shorten their opportunity to spread. Others are multipartite: they infect more than one target type, such as both executable files and boot records, so removing only one component may leave the infection active.¹

Virus detection is also less straightforward than a simple signature search. Antivirus systems combine signatures with behavioral analysis, reputation data, emulation, and rules for suspicious changes; no single method reliably identifies every variant. Defensive practice therefore includes keeping software patched, limiting unnecessary privileges, filtering attachments, maintaining offline or otherwise protected backups, and testing restoration procedures. A deliberately harmless test file, such as the EICAR test file, can verify that security products respond without using real malicious code, although it is not itself a virus.

Host

A file, program, document, or other object that a virus infects and uses for replication.

Payload

The action performed by malware after activation, such as deleting data, displaying a message, or opening access.

Boot-sector virus

A virus that infects code used during the startup process of a computer or storage device.

Polymorphism

A technique in which malware changes its apparent code or encoding across infections while retaining its behavior.

Worm

Malware that propagates independently between systems, commonly across networks, without requiring a host file.