A computer virus is a type of malicious software (malware) that self-replicates by inserting its code into other programs, files, or boot sectors. Like a biological virus, it cannot reproduce by itself — it requires a host (an executable, a document, a script) and a user action (running the file, opening an attachment) to start spreading. Once active, a virus can corrupt or delete data, steal information, slow systems, install backdoors, or hand control to an attacker. The term 'computer virus' is often used colloquially to mean any malware, but technically it refers only to self-replicating malicious code.

All four are malware but differ in *how they spread* and *what they do*: (1) Virus — self-replicates by attaching to other files, requires user action to spread, (2) Worm — self-propagates over networks without user action (e.g. WannaCry, Conficker), (3) Trojan — disguised as legitimate software, does not self-replicate, opens a backdoor or steals data once executed, (4) Ransomware — encrypts the victim's files and demands payment for the decryption key (e.g. LockBit, Conti, REvil). Modern attacks often combine techniques: a phishing email delivers a trojan, the trojan downloads ransomware, and a worm component spreads it across the network.

Seven categories: (1) File infector — attaches to executables (.exe, .com, .dll), the classic form, (2) Boot sector virus — infects the master boot record, runs before the OS loads, (3) Macro virus — written in Word/Excel macro languages (VBA), spread via documents, (4) Polymorphic virus — rewrites its own code on each infection to evade signature detection, (5) Metamorphic virus — fully recompiles itself, even harder to detect, (6) Resident virus — loads into memory and infects every file accessed, (7) Multipartite virus — combines multiple infection methods (e.g. boot + file). Modern threats are mostly trojans and ransomware rather than classic viruses, but virus techniques (especially polymorphism) live on in advanced malware.

Five historically significant: (1) ILOVEYOU (2000) — VBScript worm spread via email, infected 50M+ computers, $5–10B in damages, (2) Mydoom (2004) — fastest-spreading email worm in history, $38B in damages, (3) Stuxnet (2010) — nation-state cyberweapon targeting Iranian uranium centrifuges, the first known infrastructure-attack malware, (4) WannaCry (2017) — ransomware worm exploiting EternalBlue (NSA leak), $4B+ in damages, hit the UK NHS, (5) NotPetya (2017) — masqueraded as ransomware but was a destructive wiper, $10B in damages, the most expensive cyberattack in history. All are technically a mix of virus/worm/ransomware classes.

Six common vectors: (1) Email attachments — Word/Excel documents with malicious macros, PDF exploits, ZIP files containing executables, (2) Drive-by downloads — infected websites that exploit browser vulnerabilities, (3) Removable media — USB drives, external HDDs (still common in industrial environments), (4) Software supply chain — compromised installers, Trojanised updates (e.g. SolarWinds), (5) Network shares and SMB — old protocols, weak passwords, missing patches (WannaCry vector), (6) Social engineering — fake software, cracked games, fake updates urging install. Email and drive-by remain the leading entry points for organisations in 2026.

Layered defence — no single control is enough: (1) Modern EDR/XDR (CrowdStrike, SentinelOne, Defender for Endpoint) instead of legacy signature-based antivirus, (2) Aggressive patch management (most virus exploits are months- or years-old known CVEs), (3) Application allow-listing and SmartScreen/Defender Application Control, (4) Email filtering with sandbox detonation (Defender for Office 365, Proofpoint), (5) User awareness training and phishing simulations, (6) MFA on every critical account to limit damage from credential theft, (7) Immutable, offline backups for ransomware recovery, (8) Network segmentation to slow worm propagation, (9) Logging + 24/7 SOC monitoring to detect incidents within minutes, not weeks.

Yes — but the threat landscape has shifted. Classic file-infector viruses are rare today; modern threats are dominated by ransomware (financially motivated), info-stealers (RedLine, Lumma — credential theft), trojans (banking, RATs), and nation-state APT malware. AI-generated phishing and AI-assisted malware development have lowered the bar for sophisticated attacks. Cyber insurance carriers, Verizon DBIR and IBM Cost of a Data Breach reports consistently show ransomware as the top business-impact threat, with average breach costs above $4.5M per incident in 2025.