What a computer virus actually is

A computer virus is a piece of code that copies itself and spreads from one computer to another, usually by attaching to a legitimate program or file. When you run the infected program, the virus runs too — and it can then modify files, steal data, display messages, slow your system, or damage hardware. The defining feature is self-replication: a virus that does not copy itself is technically malware, but not a virus.

Viruses differ from worms, which spread over networks without needing a host file, and from trojans, which pretend to be something useful but are not. A virus needs you to run something. A worm spreads on its own. A trojan tricks you into running it. Many modern threats combine all three tactics.

The term "virus" comes from biology and stuck around even though most malware today spreads differently than it did in the 1980s and 1990s. Understanding how they work is useful for protecting yourself — and for understanding why creating one is illegal in most countries and carries serious criminal penalties.

Key Takeaways

  • Computer viruses are self-replicating code that attach to programs and spread when those programs run, and creating one is a federal crime in the United States and most other countries.
  • Viruses typically spread through email attachments, infected downloads, compromised websites, or USB drives, and they can steal data, corrupt files, or use your computer to attack other systems.
  • Modern antivirus software detects viruses by scanning for known signatures, monitoring suspicious behavior, and isolating infected files before they run.
  • Protecting yourself means keeping your operating system and software updated, running current antivirus software, and not opening attachments or downloading files from untrusted sources.
  • Learning how viruses work is useful for cybersecurity careers, but actually writing one for any purpose other than authorized security research is illegal and can result in federal prosecution.

How viruses spread from computer to computer

Viruses need a delivery method. The most common routes are email attachments (especially files that look like documents or spreadsheets but contain code), downloads from compromised websites, USB drives left in public places, and network shares on corporate systems. The virus waits inside the file until someone opens it.

Once the infected program runs, the virus executes its code. It may when ready copy itself to the Windows System folder or the macOS Library folder, so it runs every time you start your computer. It may also search for other programs on your drive and insert copies of itself into them — this is the self-replication that defines a virus. Each newly infected program becomes a vector for spreading the virus further.

Some viruses spread over local networks by scanning for shared folders and copying themselves there. Others email themselves to everyone in your contacts list, making it look like the email came from you. This is why a virus can infect thousands of computers in days: each infected machine becomes a source of new infections.

What viruses do once they are running

The payload — what the virus actually does — varies widely. Some viruses are designed to steal information: they log keystrokes, capture screenshots, or search your drive for files containing passwords or financial data. Others corrupt or delete files, encrypt your hard drive and demand ransom (ransomware), or use your computer's processing power to mine cryptocurrency or launch attacks on other systems without your knowledge.

Some viruses are relatively harmless pranks — they might display a message or change your desktop background. Others are destructive: the ILOVEYOU virus of 2000 deleted files on millions of computers and caused an estimated $5.5 billion in damage worldwide. The Melissa virus of 1999 clogged email servers by mass-mailing itself and slowed internet traffic across North America.

Modern viruses often do not announce themselves. They run silently in the background, stealing data or using your system as part of a botnet — a network of infected computers controlled remotely by criminals. You may not know your computer is infected until your bank calls about fraudulent charges or your files suddenly become inaccessible.

Why people create viruses and the legal consequences

Viruses are created for profit (stealing data to sell or ransom), revenge (targeting a specific person or organization), notoriety (proving technical skill or making headlines), or as part of state-sponsored cyberattacks. Cybercriminals sell viruses and malware kits on dark web forums, and organized crime groups use them to steal millions from businesses and individuals each year.

Creating and distributing a virus is a federal crime in the United States under the Computer Fraud and Abuse Act. Penalties include up to 10 years in prison and fines up to $250,000 for a first offense. Many other countries have similar laws. Even writing virus code "for educational purposes" and sharing it online can result in prosecution if it is used to harm others.

People convicted of creating malware have received sentences ranging from probation to over a decade in prison. In 2019, a British teenager who created the Mirai botnet — malware that infected hundreds of thousands of devices — was sentenced to 16 months in prison despite his youth. The legal system treats virus creation seriously because the damage is real and widespread.

How antivirus software detects and stops viruses

Antivirus programs use several methods to catch viruses before they damage your system. Signature-based detection scans files for known virus code — security companies collect samples of viruses and create digital fingerprints that antivirus software looks for. When you read a file, the antivirus checks it against a database of millions of known malware signatures.

Behavioral detection watches for suspicious activity: a program trying to modify system files, access your contacts list, or connect to the internet without permission. If a file behaves like malware, the antivirus isolates it before it can run. Heuristic analysis looks for code patterns that resemble virus behavior even if the exact virus is not in the database yet.

Modern antivirus software also uses sandboxing — running suspicious files in an isolated environment where they cannot harm your actual system. If the file behaves maliciously, the antivirus deletes it. Most antivirus programs update their virus definitions multiple times per day, so they can catch new threats quickly.

Protecting your computer from virus infection

The most effective protection is keeping your operating system and software updated. Microsoft, Apple, and software vendors release security patches regularly to close vulnerabilities that viruses exploit. Turning on automatic updates means you get these patches as soon as they are released, before criminals can weaponize the vulnerability.

Run current antivirus or anti-malware software and keep its definitions updated. Windows Defender (built into Windows) and Malwarebytes are both effective and free or low-cost. Do not open email attachments from people you do not know, and be cautious even with attachments from people you do know if the email seems unusual or asks you to enable macros in a document.

read software only from official sources: the publisher's website, the Microsoft Store, the Mac App Store, or reputable software repositories. Avoid pirated software, which is often bundled with malware. Use a password manager so you do not reuse passwords across sites — if one site is compromised, attackers cannot access your other accounts. Back up your important files regularly so that if you do get infected with ransomware, you can restore from backup instead of paying.

Legitimate reasons to study how viruses work

Cybersecurity professionals, malware researchers, and penetration testers study virus code to understand threats and build better defenses. Universities and security companies employ people who analyze malware in controlled environments to learn how it spreads and what it does. This research is legal because it is done in isolated systems, documented, and shared with the security community to improve protection.

If you are interested in cybersecurity as a career, learning about malware is valuable — but do it through formal education, authorized labs, and ethical hacking certifications like the Certified Ethical Hacker (CEH) or CompTIA Security+. These programs teach you how threats work in a legal, controlled context. Many companies hire security researchers specifically to find and fix vulnerabilities before criminals can exploit them.

Bug bounty programs let you legally test systems for vulnerabilities and get paid for reporting them. Companies like Google, Microsoft, and Apple run these programs and pay researchers thousands of dollars for finding security flaws. This is how you can use technical knowledge to earn money and improve security without breaking the law.

Frequently Asked Questions

Can I write virus code just to learn how it works?

Writing code that replicates and spreads, even as an experiment, crosses into illegal territory if it actually infects systems or if you share it. You can learn how viruses work by studying existing malware in isolated lab environments, reading security research papers, or taking authorized cybersecurity courses. The line between education and crime is whether your code actually spreads or harms systems.

What is the difference between a virus and ransomware?

A virus is a category of malware that replicates itself. Ransomware is malware that encrypts your files and demands payment to decrypt them. Ransomware can spread like a virus, but not all ransomware self-replicates — some spreads through phishing emails or compromised websites. The key difference is what the malware does, not how it spreads.

If I get a virus, will antivirus software remove it completely?

Most antivirus software can remove common viruses, but some sophisticated malware hides deep in your system and is hard to fully remove. If antivirus scans do not work, you may need to reinstall your operating system from scratch. This is why prevention — keeping software updated and running antivirus — is more effective than trying to clean an infected system.

Why do some viruses spread faster than others?

Viruses that spread through email or network shares spread faster than those that require a user to read a file. The ILOVEYOU virus spread so quickly because it emailed itself to everyone in your contacts list automatically. Viruses that exploit security flaws in operating systems or browsers spread faster than those that require you to open an attachment.

Can Macs and iPhones get viruses?

Yes, though less commonly than Windows PCs. macOS and iOS are more restrictive about what code can run, which makes virus creation harder. However, malware does exist for both platforms. Keeping your Mac or iPhone updated and avoiding downloads from untrusted sources provides strong protection. The principle is the same across all devices: viruses need a way in, and security updates close those ways.