Computer viruses are one of the most familiar cyber security threats, but the term is often used too broadly. Many people call every harmful programme a “virus”, even when it is actually a worm, trojan, spyware or ransomware. In proper cyber security language, a computer virus is a specific type of malware that attaches itself to a host file, programme, document or system area and can copy itself when that host runs.
They are malicious pieces of code designed to interfere with normal computer activity. Depending on how they are built, they may damage files, slow down a device, change data, display unwanted messages, steal information, or help criminals gain further access to a system.
When people ask “what are computer viruses and examples? a simple example is a macro virus hidden inside a spreadsheet or document. If the user opens the file and enables macros, the malicious code may run. Another example is a boot sector virus, which infects the part of a drive used during start-up.
Computer viruses are not physical germs and they are not alive. They are made of code. That code contains instructions telling the virus what to infect, when to activate, how to copy itself and what harmful action to perform.
Viruses matter because one infected file can create wider disruption. A personal laptop may lose important documents. A business may face downtime. A school, training provider or office may have shared files infected across multiple devices. This is why virus awareness is still an important part of cyber security training, even though modern threats now include many other forms of malware.
How They Work
Computer viruses usually work through three connected stages: they attach to a host, replicate and spread. Some also carry a payload, which is the part of the virus that performs the harmful action.
The payload may be mild, such as showing an unwanted message. It may be disruptive, such as corrupting files or slowing down the device. In more serious cases, it may delete data, weaken security settings or open the door to other malware.
A virus does not always cause damage immediately. Some remain hidden until a certain action happens, such as opening a file, restarting the device, reaching a particular date, or running an infected programme. This delay can make infections harder to notice.
For example, a user may download what looks like a normal file. Nothing obvious happens at first. Later, the virus activates, infects other files and begins causing errors. By the time the user notices the problem, the infection may have already spread.
This is why prevention matters. Once a virus has copied itself across a device or network, removing it can take more time than blocking it in the first place.
The “Host” Requirement
The host requirement is one of the key features of a computer virus. A virus usually needs something to attach to. This may be a document, executable file, application, script, drive area or system file.
The host carries the virus code. When the host runs, the virus gets the opportunity to run as well.
| Possible host | Example |
| Document | A Word or Excel file with malicious macros |
| Programme file | An infected software installer or executable file |
| Boot area | The boot sector of a hard drive or removable drive |
| Script | A file containing commands that run automatically |
| Shared file | A file stored in a shared workplace folder |
This host requirement helps explain the difference between viruses and some other malware. A worm, for example, can often spread by itself across networks without needing to attach to a host file in the same way. A trojan pretends to be useful or harmless software, but it does not necessarily replicate like a virus.
A virus becomes active when the infected host is opened, launched or triggered. If the infected file stays untouched, the virus may not be able to do anything. However, this does not make it safe. The danger remains because someone may run the file later.
In workplaces, the host requirement is one reason infected attachments and shared documents are risky. A single unsafe document may be opened by several people, especially if it looks like an invoice, report, timetable, CV, assessment file or internal notice.
Replication
Replication means the virus makes copies of itself. This is the behaviour that gives it the name “virus”.
Once active, a virus may search for other suitable files or system areas. It may insert its code into them so that they also become infected. When those infected files run, the process can continue.
Replication can happen quietly in the background. A user may not immediately see anything unusual. The device may still appear to work normally while the virus copies itself to more files.
Different viruses replicate in different ways. A macro virus may copy itself into other documents. A file-infecting virus may attach itself to executable files. A boot sector virus may infect storage media so that it activates during start-up.
Replication can create two major problems. First, it increases the number of infected files. Second, it makes removal harder. If only one infected file is removed but other infected files remain, the virus may return.
This is why a proper scan is important. Deleting one suspicious file may not be enough. Trusted security software can check wider areas of the device and identify related infections.
Spreading
When people ask “what are computer viruses and how do they spread?”, the answer is that they spread through infected files, unsafe downloads, removable devices, email attachments, shared folders and sometimes networked systems.
A virus usually needs movement. It spreads when the infected host moves from one device, user or location to another.
| Spreading route | How it can happen |
| Email attachments | A user opens an infected document or file |
| Removable drives | An infected USB drive is connected to another device |
| File sharing | Infected files are uploaded, downloaded or copied |
| Shared workplace folders | Multiple users open the same infected file |
| Unsafe downloads | A user installs software from an untrusted source |
| Compromised websites | A user is tricked into downloading a malicious file |
| Old software | Security weaknesses allow malware to run more easily |
Many virus infections depend on human action. Someone opens the attachment, clicks the link, enables macros, installs the programme or connects the device. Attackers know this, so they often use social engineering to make the action feel normal or urgent.
For example, a phishing email may say that an invoice is overdue or a delivery has failed. The attachment may look like a normal document. If the user opens it and enables content, the virus may activate.
Viruses may also spread through poor security habits. Reusing old devices without scanning them, sharing files without checking the source, ignoring warnings and downloading cracked software can all increase risk.
Common Warning Signs
Computer virus symptoms can vary. Some viruses are noisy and obvious. Others are designed to stay hidden for as long as possible. A slow computer does not automatically mean there is a virus, but it should be taken seriously if it appears with other unusual signs.
Common warning signs include:
| Warning sign | What it may suggest |
| Slow performance | Malware may be using memory or processing power |
| Frequent crashes | Files or system processes may be damaged |
| Strange pop-ups | Adware or other unwanted software may be present |
| Unknown programmes | Suspicious software may have been installed |
| Missing or changed files | Data may have been altered or corrupted |
| Browser redirects | Web settings may have been hijacked |
| Security software disabled | Malware may be trying to avoid detection |
| Unusual network activity | The device may be contacting unsafe servers |
| Emails sent without permission | The device or account may be compromised |
| Device overheating | Hidden processes may be running heavily |
| Start-up problems | Boot areas or system files may be affected |
| Repeated error messages | Programmes may be damaged or infected |
One warning sign alone may have a harmless explanation. A device can slow down because of age, low storage or too many apps running. However, several signs together should be investigated.
For individuals, the safest response is to stop using the device for sensitive activity until it is checked. Avoid online banking, shopping or entering passwords on a device that may be infected. Run a scan with trusted security software and change important passwords from a clean device.
For organisations, employees should report symptoms quickly. A staff member should not try to hide the problem or fix it with random tools from the internet. Quick reporting helps IT teams contain the issue before it affects shared drives, cloud folders or other users.
Common Types
There are many types of computer viruses. Some are classified by where they infect. Others are classified by how they behave. When people search for “what are computer viruses and its types?”, they usually need a practical explanation rather than a long technical list.
The three important types in this article are macro viruses, boot sector viruses and resident viruses. These are useful for beginners because they show how different viruses use different hosts and activation methods.
Macro Viruses
A macro virus infects documents or files that use macros. Macros are small scripts that automate tasks in applications such as word processors and spreadsheets.
Macros can be legitimate. Businesses may use them to format reports, calculate figures or process repeated tasks. The danger is that attackers can hide malicious instructions inside a macro-enabled file.
A common scenario is a fake invoice, delivery notice, job document or internal report sent as an email attachment. The document may ask the user to “enable content” or “enable macros” to view it properly. If the user does this, the malicious macro may run.
Macro viruses can spread through email, shared folders and collaboration platforms. They are effective because the infected file may look like an ordinary work document.
Possible effects include changing documents, creating unwanted files, sending infected documents to other contacts or downloading further malware.
Protection against macro viruses includes opening unexpected attachments carefully, keeping macros disabled unless truly needed, using protected view, checking the sender and reporting suspicious files at work. If a document asks you to enable macros for no clear reason, treat it with caution.
Boot Sector Viruses
A boot sector virus infects the part of a drive used when a computer starts. This area contains information needed during the boot process. If that area is infected, the virus may run before the operating system fully loads.
Boot sector viruses were especially common when floppy disks were widely used. They are less common today, but the idea still matters because malware that affects start-up areas can be difficult to detect and remove.
A boot sector virus may spread through infected removable media, such as USB drives or external storage devices. If a computer tries to start from infected media, the virus may load and infect the device.
Symptoms may include start-up errors, failure to boot, unusual disk behaviour, system instability or files becoming inaccessible.
Protection includes avoiding unknown USB drives, scanning removable media, keeping boot settings secure, updating systems and using trusted security tools. In a workplace, unknown storage devices should not be connected to company computers without permission.
Resident Viruses
A resident virus installs itself in a computer’s memory. Once active, it may continue running in the background and infect other files as they are opened, copied or used.
This makes resident viruses harder to deal with than a simple infected file. Even if the user deletes one infected file, the virus may still be active in memory and may infect new files.
Resident viruses can cause slow performance, corrupted files, programme errors, unusual system behaviour and repeated reinfection. They may also interfere with security tools or hide their activity.
Removing a resident virus may require a full system scan, restarting in safe mode, specialist removal tools or professional IT support. In business environments, it may also require checking connected systems because infected files may have moved through shared folders or network drives.
Resident viruses show why partial fixes are risky. If the device is still behaving strangely after one file is removed, a deeper scan and investigation may be needed.
Other Computer Virus Names and Examples
People often search for computer virus names, common computer viruses and famous computer viruses. Knowing a few examples can be useful, but it is important to remember that many famous threats are casually called viruses even when they are technically another type of malware.
| Name | Category | Why it is known |
| Melissa | Macro virus | Spread through infected Word documents and email |
| Michelangelo | Boot sector virus | A well-known early boot sector virus |
| CIH/Chernobyl | File-infecting virus | Known for destructive behaviour on some infected systems |
| ILOVEYOU | Worm, often casually called a virus | Spread widely through email attachments |
| Conficker | Worm | Spread through Windows systems and networks |
| WannaCry | Ransomware worm, not a traditional virus | Caused global disruption by encrypting files |
This distinction matters because “virus” is not the same as “malware”. A virus is a type of malware, but malware is the wider category. Malware includes viruses, worms, trojans, spyware, ransomware, adware and other harmful software.
For a beginner, the easiest rule is this: if the harmful software attaches to a host and replicates when that host runs, it is closer to a traditional virus. If it spreads by itself across networks, pretends to be legitimate software, spies on users or locks files for ransom, it may belong to another malware category.
Computer Virus and Antivirus
The relationship between computer virus and antivirus is straightforward. Viruses try to infect systems and files. Antivirus, or modern anti-malware software, tries to detect, block, quarantine and remove harmful software.
Traditional antivirus tools often used signatures. A signature is a known pattern linked to a specific threat. If the security tool finds that pattern, it can flag the file as malicious.
Modern security software goes further. It may also look at behaviour. For example, if a programme suddenly tries to modify many files, disable security tools or contact suspicious servers, the software may treat it as dangerous even if the exact threat is new.
Antivirus can help protect against computer viruses, but it should not be treated as the only defence. No tool catches everything. Attackers constantly change their methods, and some infections rely on tricking the user rather than breaking through technical controls.
This is why cyber security works best in layers. Security software, updates, backups, safe clicking, access control, strong passwords and staff awareness all support each other.
For businesses, antivirus should be properly managed. It should be active across devices, updated regularly and monitored. Alerts should be reviewed rather than ignored. For individuals, built-in protection may be suitable in many cases, but it still needs to be kept on and updated.
How to Protect Yourself
Computer viruses can be disruptive, but many infections are preventable. The goal is not to use the internet with fear. The goal is to build safe habits that reduce unnecessary risk.
The three most important areas are security software, updates and safe clicking.
Use Security Software.
Use trusted security software and keep it enabled. Security software can scan files, block known threats, warn about unsafe downloads, quarantine suspicious items and help remove infections.
For many modern devices, built-in security protection already provides an important first layer. Some users and organisations may choose additional protection depending on their risk level, device type and business needs.
Good security software habits include:
| Action | Why it matters |
| Keep protection switched on | Malware can enter when defences are disabled |
| Allow security updates | New threats require updated detection |
| Run regular scans | Hidden or inactive threats may be found |
| Use real-time protection | Threats can be blocked before they run |
| Review warnings carefully | Alerts may stop unsafe files or websites |
| Avoid conflicting tools | Too many security tools can cause problems |
If your security software warns you about a file, download or website, pause before continuing. Do not switch protection off just to open something quickly.
In organisations, employees should not install their own security tools without approval. IT teams need consistent protection across devices so they can manage updates, alerts and incidents properly.
Keep Systems Updated
Keeping systems updated is one of the simplest ways to reduce virus and malware risk. Updates often fix security weaknesses that criminals may try to exploit.
This includes:
| What to update | Examples |
| Operating systems | Windows, macOS, Linux, Android, iOS |
| Browsers | Chrome, Edge, Safari, Firefox |
| Office software | Word processors, spreadsheets, email clients |
| Security tools | Antivirus and anti-malware software |
| Apps and plugins | PDF readers, communication tools, business apps |
| Firmware | Routers, printers and other connected devices |
Where possible, turn on automatic updates. This is especially useful for personal devices, browsers and mobile apps.
For businesses, updates should be managed properly. Important patches should not be ignored, especially where a vulnerability is known to be serious. Older systems that no longer receive security updates should be replaced or isolated because they can become easy targets.
Updates may feel inconvenient, but delaying them can create avoidable risk. Many attacks succeed not because the attacker is highly advanced, but because the victim is using old software with known weaknesses.
Practice Safe Clicking
Safe clicking is one of the most practical ways to avoid viruses. Many infections begin when someone opens an attachment, downloads unsafe software, enables macros or clicks a fake link.
Before clicking, ask simple questions. Was I expecting this file? Do I recognise the sender? Is the link going to the real website? Why is the message creating urgency? Is it asking me to enable something unusual?
Common risky actions and safer habits include:
| Risky action | Safer habit |
| Opening unexpected attachments | Confirm through a trusted channel |
| Enabling macros | Only enable them when necessary and trusted |
| Downloading free software | Use official websites and trusted app stores |
| Clicking urgent links | Visit the website directly instead |
| Using unknown USB drives | Avoid them or have them checked first |
| Ignoring browser warnings | Stop and investigate |
| Installing cracked software | Avoid it completely |
| Sharing files casually | Check source, permissions and need |
Phishing messages often use pressure. They may claim that an account will close, a payment has failed, a parcel is waiting, or a manager needs urgent help. The aim is to make the user act before thinking.
Safe clicking does not mean never clicking anything. It means slowing down when something is unexpected, urgent, unusual or too good to be true.
In workplaces, staff should report suspicious messages rather than simply deleting them. Reporting helps the organisation warn others and block similar attempts.
What to Do If You Suspect a Virus
If you think your computer has a virus, act calmly and avoid making the situation worse.
First, stop using the device for sensitive activity. Do not log into banking, work accounts or important email accounts from a device that may be infected.
If the device is behaving suspiciously, disconnect it from the internet. This may help limit further communication with unsafe servers or reduce the risk of spreading in a workplace network.
Next, run a full scan using trusted security software. Follow the recommended steps to quarantine or remove threats. If the scan finds malware but problems continue, seek proper technical support.
If you are using a work, school or training provider device, report the issue to IT support immediately. Do not try to hide it. A quick report can prevent the infection spreading to shared systems.
Change important passwords from a clean device, especially for email, banking, cloud storage and work accounts. Turn on multi-factor authentication where available.
If files are missing, locked or encrypted, do not download random “repair” tools from unknown websites. They may make the problem worse. For serious incidents, organisations should follow their incident response process and consider appropriate UK reporting routes where cyber crime or data loss is involved.
Final Thoughts
Computer viruses are malicious code that usually attach to a host file, document, programme or system area. When the infected host runs, the virus may activate, replicate and spread.
The key points are simple. A virus usually needs a host. It copies itself through replication. It spreads through infected files, attachments, downloads, removable drives and shared systems. It may cause symptoms such as slow performance, crashes, pop-ups, missing files, disabled security tools or unusual account activity.
Common types include macro viruses, boot sector viruses and resident viruses. Famous computer virus names and examples include Melissa, Michelangelo and CIH/Chernobyl. Other well-known threats such as ILOVEYOU, Conficker and WannaCry are often called viruses in everyday language, but they are technically different forms of malware.
Antivirus and anti-malware tools are useful, but they work best as part of a wider security routine. Use security software, keep systems updated and practise safe clicking. Avoid suspicious attachments, unnecessary macros, unsafe downloads and unknown USB devices.
For anyone learning cyber security, understanding computer viruses is a strong starting point. It explains how malicious code can attach, copy, spread and cause harm. It also shows why everyday cyber hygiene matters for individuals, students, employees and organisations.