A computer virus is not alive, but it behaves like something alive: it hides inside a host, copies itself, and spreads to new victims. Understanding how that actually works — in plain English, without jargon — is the single most useful thing you can know about staying safe online, because almost every scam, ransomware attack, and data breach starts with the same basic trick.
First, what is a virus?
A computer virus is a small piece of malicious software — malware — that attaches itself to a legitimate file or program and copies itself when that file runs. The name comes from biology, and the comparison is surprisingly accurate: just as a biological virus needs a living cell to reproduce, a computer virus needs a host program to run.
Not all malware is a virus, though people use the word for everything. The family has several members:
- Virus: attaches to a file and needs you to run that file to spread.
- Worm: copies itself across a network on its own — no host file, no click needed.
- Trojan: pretends to be a useful program (a free game, a "system cleaner") while secretly doing something harmful.
- Ransomware: locks your files and demands payment to unlock them.
- Spyware: quietly watches what you type and where you browse, then sends it to someone else.
Most modern attacks are blends — a Trojan that drops ransomware, a worm that carries spyware — but the core idea is always the same: code that runs without your real permission.
How a virus infects a computer
A virus needs three things to succeed: a way in, a place to hide, and a trigger to run.
The way in is almost always you. Viruses rarely break into a computer by force. Instead they arrive disguised as something you want: an email attachment labelled "invoice" or "I love you", a pirated program, a fake software update, a USB stick left in a car park. You open it, and the virus runs. Security researchers call this social engineering — tricking the human, not the machine — and it works because humans are far easier to fool than computers.
The place to hide is a file you already trust. When a classic virus runs, it quietly inserts a copy of its own code into other programs on your computer — your word processor, your browser, a system file. From then on, every time you open one of those infected programs, the virus runs first, then hands control back to the program so nothing looks wrong.
The trigger is whatever makes the virus act. Some viruses spread immediately. Others wait — for a date, for a number of infections, for a command from a remote server. Waiting is smart: a virus that acts at once gets noticed and removed; a virus that spreads quietly for weeks can infect thousands of machines before anyone realises.
How a virus spreads
Once inside, a virus spreads the way a rumour spreads: through every channel its host uses.
- Email: the virus reads your contacts and mails itself to everyone you know, often from your own address — which is why the message looks trustworthy.
- Shared files and drives: it infects documents on shared folders and cloud drives, so colleagues and family pick it up.
- USB sticks and external drives: it copies itself onto anything plugged in, then jumps to the next computer that stick touches.
- Networks: worms scan the local network for other computers with the same weakness and copy themselves across, no human help needed.
- Downloads: it bundles itself with free software, cracked games, or fake updates from shady websites.
Speed is the point. The ILOVEYOU worm of May 2000 spread by email with the subject line "ILOVEYOU" and an attachment called LOVE-LETTER-FOR-YOU. It infected an estimated 10 million computers within days, and the damage ran into the billions of dollars — all because millions of people opened a love letter from a stranger.
A short history of famous viruses
Virus history reads like a timeline of the internet itself, and the milestones show how the threat changed:
| Virus | Year | What it did |
|---|---|---|
| Creeper | 1971 | The first self-copying program; it hopped between computers and printed "I'm the creeper, catch me if you can!" — more prank than attack. |
| Brain | 1986 | The first virus for personal computers; spread on floppy disks and hid in the boot sector. |
| Morris worm | 1988 | The first internet worm. Built by Cornell graduate student Robert Morris, it infected about 6,000 computers in a day — roughly 10% of the internet at the time — and Morris became the first person convicted under America's Computer Fraud and Abuse Act. |
| ILOVEYOU | 2000 | Email worm that infected around 10 million Windows PCs and caused billions of dollars in damage. |
| Stuxnet | 2010 | Discovered in June 2010; the first true cyber-weapon. It targeted industrial control systems at Iran's Natanz uranium facility, physically damaging about 1,000 centrifuges — the first virus to break real-world machinery. |
The pattern is clear: viruses went from pranks, to crime, to weapons. Today's ransomware gangs run like businesses, with customer service and profit targets.
How your computer fights back
Your defences work in layers, and each layer catches what the previous one missed:
- Antivirus software scans files against a huge list of known virus "signatures" — unique fingerprints of malicious code — and watches programs for suspicious behaviour, like a word processor suddenly trying to change system files.
- Your operating system runs programs in sandboxes, asks permission before installing software, and patches security holes with updates. Every update you postpone is a door left open.
- Your browser and email warn you about dangerous downloads and block known malicious websites.
- Firewalls control which programs can talk to the internet, so a virus that does get in cannot easily phone home or spread.
No single layer is perfect, which is why they are stacked. A virus has to beat all of them, not just one.
Why viruses still win
If the defences are so good, why do viruses still work? Three reasons:
People click. The most advanced security in the world cannot stop someone opening an attachment they believe is a delivery notice. Phishing — fake emails that look real — remains the number-one infection method.
Software has holes. Every program contains bugs, and some bugs let attackers run their own code. When a bug is discovered, companies race to patch it — and attackers race to exploit it before everyone updates. The 2010 Stuxnet worm, for example, used several previously unknown Windows flaws.
Old systems never get patched. Millions of computers still run outdated software, and one unpatched machine on a network can infect the rest.
How to protect yourself
You do not need to be a security expert. A few habits block the vast majority of infections:
- Keep everything updated — your operating system, your browser, your apps. Updates are mostly security fixes.
- Do not open unexpected attachments, even from people you know. If an email feels off, check with the sender another way first.
- Download software only from official sources. Free versions of paid software from random websites are the classic virus delivery method.
- Use strong, unique passwords and turn on two-factor authentication, so a stolen password alone is not enough.
- Back up your files regularly to a drive you then disconnect. A backup is the only reliable cure for ransomware.
- Be suspicious of urgency. "Your account will be closed in 24 hours" and "open this invoice now" are the two most common virus lures in existence.
Viruses work because they exploit trust — trust in an email, trust in a download, trust in a familiar name. Once you see the trick, it stops working on you. That is the whole defence, really: a virus is just code, and code cannot do anything until someone runs it.
Takeaway checklist
- A virus is code that copies itself into your files and needs a host program to run; worms spread on their own.
- Infection almost always starts with a human click — a fake attachment, a dodgy download, a tempting link.
- Viruses hide inside trusted files, spread through email, USB sticks, shared drives and networks, and often wait before acting.
- Famous milestones: Creeper (1971), Brain (1986), Morris worm (1988, ~6,000 computers), ILOVEYOU (2000, ~10 million PCs), Stuxnet (2010, broke real machinery).
- Defence is layered: antivirus, operating-system updates, browser warnings, and firewalls each catch what the others miss.
- Your habits are the strongest layer: update everything, don't open unexpected attachments, download only from official sources, back up your files.
- If it creates urgency, slow down — urgency is the virus's favourite disguise.
Read next: How Ransomware Works, Explained and How Do Firewalls Actually Work?.
