Malicious code (malware): computer virus

The idea

A computer virus is a piece of malicious code that attaches itself to a legitimate program or file and only runs when that host is executed. Once active it can replicate by copying itself into other files, so it spreads when infected files are shared, for example by email attachment or USB stick. It may also carry a payload that corrupts or deletes data, slows the system or displays unwanted messages. The key idea for the exam is the dependency on a host plus self-replication: a virus cannot spread on its own without a user running the infected file. Contrast this with malware that spreads across a network unaided. When answering, identify the attachment to a host file, the trigger of user execution, the replication and the possible payload, and distinguish a virus from other malware types such as a trojan or worm.

What earns the marks

• A virus is malicious code that attaches to a legitimate program or file (its host).

Common mistakes and how to put them right

• Treating any harmful program as a virus.

  Put it right: A virus specifically attaches to a host file and needs that file to be run.

• Claiming a virus spreads across a network by itself with no user action.

  Put it right: That self-spreading behaviour describes a worm, not a virus.

• Assuming a virus always destroys data immediately.

  Put it right: A virus may lie dormant and may carry no damaging payload, or a payload that only disrupts.

Exam tips

• Look for the word 'attaches' or 'host file' in an option; that signals a virus rather than other malware.
• Reject options describing unaided network spreading, which point to a worm.
• Link the virus to a route of spread such as an email attachment or shared USB drive to confirm the answer.