Viruses: The Classic Self-Replicating Malware

What a virus is and how it spreads

A virus is a malware family member that rides inside another file or program — its host — and only spreads when that host runs. Microsoft’s definition centers on replication: the virus copies its code into other files or programs, and the infected file still looks ordinary. NIST's malware guide describes the general pattern: malicious code is covertly inserted, aiming to destroy data or to harm the victim's system across all three security goals — confidentiality, integrity, and availability.

Infection starts through ordinary actions. NIST lists the classic routes: infected email attachments, malicious websites, and removable media such as a borrowed USB drive. When a user opens an infected attachment or runs an infected program, the virus executes and copies itself into other files, and the chain continues the next time one of those hosts runs. Notice what is missing: no exotic technique. Every route depends on something normal — an email, a download, a drive — being used at the wrong moment. That is why the defense begins with attention, not with special tools.

The family line: viruses, worms, and the malware umbrella

The word "virus" is used loosely, but the technical definition is precise — and the precision matters. A virus needs two things: a host to travel in and, usually, a human action like opening a file, because the virus only executes when that host runs. If the host never runs, the virus stays dormant inside it.

A worm is the family's opposite: it replicates and spreads by itself, crossing networks without needing anyone to open a file or attachment. Microsoft's comparison is the cleanest: a virus needs the host program to run, while a worm needs no direct intervention at all.

Both are members of a larger family. Malware is the umbrella term for harmful software of every kind, and NIST's glossary lists viruses, worms, and trojan horses as code-based entities that infect hosts. Trojans wear a desirable disguise and usually hand an attacker access; ransomware locks or encrypts data for payment. Each of those families gets its own lesson — here, the point is simply that "virus" names one specific behavior, not the whole category.

Signs of infection

What does an infected machine look like? Microsoft's guidance names the usual warning signs: performance that suddenly drags, pop-ups that appear from nowhere, programs launching on their own, and settings that change by themselves. Strange messages and files changing on their own — new files where none were created, or settings that no longer behave — fit the same pattern. The honest caveat is that signs are clues, not proof: some malware is designed to hide, and a quiet computer is not automatically a clean one. When signs appear, the right response is to run security software and investigate, not to assume and ignore.

Defense, and the honest limit

Defense is three habits that work together. First, be wary of unexpected attachments: NIST recommends not opening them even when they seem to come from a known contact, and checking through another channel when one arrives without warning. Second, keep software updated: CISA urges installing updates promptly and enabling automatic updates, because providers ship fixes for the weak spots malware exploits. Third, use security software: NIST describes antivirus software as the most widely used malware-control measure, and it should be kept updated like everything else.

And then the honest part, stated plainly by the sources. NIST is explicit that incidents still happen — brand-new threats and human mistakes slip through, and technical controls cannot stop everything. Viruses are an old threat, one of the oldest in computing, but they are not a dead one; the same habits that blocked them decades ago still matter today. Defense reduces risk substantially; it never reduces it to zero.