A computer virus is a type of malware that spreads by attaching itself to files, programs, documents, scripts, or boot areas and then copying itself when the infected item runs. Not every malware infection is technically a virus, but viruses remain one of the clearest ways to explain why a PC can suddenly slow down, corrupt files, show strange pop-ups, or spread malicious files to other people.
If you suspect a virus, do not keep opening the same file to “test” it. Disconnect from risky downloads, save important work, and scan the system. This guide explains what computer viruses are, what they do, how they replicate, which virus types matter, and how to reduce infection risk. If you need a symptom-by-symptom triage checklist, use our PC infection warning signs guide.
What is a computer virus?
A computer virus is malicious code that can replicate by infecting another file, program, document, macro, script, or disk area. NIST describes a virus as hidden, self-replicating software that propagates by inserting a copy of itself into another program. In everyday language, people often say “virus” for any malware, but the technical meaning is narrower: all computer viruses are malware, while not all malware is a virus.
This distinction matters when you are trying to clean a PC. A virus may infect files and keep coming back from infected documents or removable drives. A trojan may pretend to be a safe installer. Ransomware may encrypt files. Adware may hijack browsers. The cleanup path depends on what the threat is doing, not only on the label used in a pop-up or search result.
How computer viruses work
Most viruses follow the same basic chain: they arrive through a file or weakness, wait for a trigger, replicate into other places, and then run their payload. That payload can be mild, such as nuisance pop-ups, or serious, such as file corruption, credential theft, destructive changes, or malware downloads.
- Entry: the virus reaches the PC through an attachment, cracked installer, infected document, malicious script, unsafe USB drive, or compromised download.
- Trigger: the infected file opens, a macro runs, a script executes, or the system starts from an infected boot area.
- Replication: the virus copies itself into files, folders, macros, shortcuts, startup locations, or removable media.
- Payload: the virus performs the harmful action: changing files, slowing the system, hiding data, spreading to contacts, or installing additional malware.
What does a computer virus do?
A virus can do more than slow a computer down. Its first job is replication: it attaches to a host file, document, macro, script, shortcut, or boot area so the infected item can carry the code forward. The payload is the separate harmful action the virus performs after it runs.
- File damage: executable files, documents, or shortcuts may be modified, corrupted, renamed, hidden, or replaced.
- System disruption: Windows may slow down, crash, lose settings, or fail to open security tools normally.
- Data exposure: some virus families install additional malware that can steal passwords, browser sessions, or files.
- Further spread: infected documents, removable drives, shared folders, or outgoing messages can carry the threat to another device.
When symptoms may point to a virus
Symptoms are useful context, but they do not prove that the threat is a classic self-replicating virus. File-infecting and macro viruses are more likely when you see file corruption, repeated detections on the same documents or programs, suspicious shortcut files on removable drives, or alerts that return after the infected source is opened again.
- Executable files, Office documents, scripts, or shortcuts change unexpectedly.
- Antivirus alerts return after the same file, folder, archive, or USB drive is used again.
- Programs that worked before become corrupted, renamed, or repeatedly flagged.
- Security tools, Task Manager, browser settings, or Windows Update stop working together with file changes.
- Removable drives show hidden files, strange shortcuts, or copied malware-like files.
For broader malware symptoms such as pop-ups, redirects, suspicious processes, account abuse, or fake alerts, use the dedicated infected PC checklist.
How viruses spread
Modern viruses rarely spread through only one channel. Attackers combine social engineering, old software, malicious documents, and fake downloads so the infection looks like something the user expected to open.
- Email attachments and links: invoices, delivery notices, resumes, tax documents, and shared files can hide malicious scripts or macro-enabled documents.
- Downloads and cracked software: fake installers, keygens, game mods, codecs, and “free” apps often carry malware bundles.
- Office macros and scripts: documents can ask the user to enable content, then run code that downloads or launches malware.
- USB drives and removable media: infected drives can carry malicious shortcuts, autorun tricks, or infected files between computers.
- Outdated software: old browsers, document readers, plugins, and unpatched Windows components give malware more ways to run.
- Malvertising and fake alerts: unsafe ads and scareware pages push fake updates, fake virus warnings, and malicious downloads.
Types of computer viruses
| Virus type | How to recognize it | What to do first |
|---|---|---|
| File infector | Executable files or program folders become suspicious, broken, or repeatedly detected. | Stop running the affected apps, scan the full system, and reinstall damaged software from trusted sources. |
| Macro virus | A Word or Excel file asks to enable macros or content before showing the real document. | Do not enable macros for unexpected files. Delete the document and scan downloaded files. |
| Boot sector virus | The system has startup problems after using removable media or old external drives. | Remove unknown USB drives, scan offline if possible, and check boot recovery options. |
| Multipartite virus | Both startup behavior and regular files are affected, making the infection return after partial cleanup. | Run a full scan, check removable media, and avoid restoring infected files from backups. |
| Polymorphic virus | Detections change names or variants because the code mutates to avoid simple signatures. | Update your security tool before scanning and use behavior-based detection where available. |
| Resident virus | The infection stays active in memory and keeps reinfecting files while Windows is running. | Restart into a safer scan mode or use an offline/second-opinion scan when normal cleanup fails. |
Computer virus examples
Modern users often meet “virus” as a broad warning label, but true virus behavior is easier to recognize through examples:
- Macro virus: an Office document asks you to enable macros, then runs code that infects documents or downloads malware.
- File infector: a threat such as Win32/Expiro can modify executable files, so cleaning only the first download may not be enough.
- Boot or removable-drive virus: an infected USB drive or boot area carries malicious shortcuts, hidden files, or startup code to another computer.
- Polymorphic virus: the code changes enough to avoid simple signatures while keeping the same basic behavior.
Computer virus vs malware
Malware is the broad category for malicious software. Viruses, worms, trojans, spyware, ransomware, adware, and rootkits all belong under that umbrella. A virus is different because replication is part of its behavior: it infects another host file or area and spreads through that infected object.
This is why a generic “remove the virus” instruction can be misleading. If the problem is a browser hijacker, you need to remove extensions and reset browser settings. If it is ransomware, you need to protect backups and avoid paying before triage. If it is a file-infecting virus, you may need to replace damaged programs rather than simply deleting one downloaded file.
How to confirm a virus-specific infection path
When a scan or symptom pattern points to a real virus, focus on the source that can reintroduce it. The main question is whether an infected file, document, script, boot area, or removable drive keeps bringing the same threat back.
- Identify the repeated source: note the exact file path, document, archive, USB drive, or folder named in the alert.
- Stop reopening suspicious files: testing the same file can trigger replication or restore the infection.
- Scan the full system and removable media: a file infector or shortcut-style spreader can survive outside the first downloaded file.
- Check whether the detection returns after reboot: repeated alerts can mean persistence, reinfection from a source file, or an infected backup.
- Use the symptom checklist when the behavior is broader: if the issue is mainly slow performance, redirects, fake alerts, or stolen accounts, switch to the malware warning signs guide.
Virus-specific cleanup basics
Cleanup depends on what the virus infected. A simple malicious download may be quarantined once, but file infectors, macro viruses, and removable-drive infections can return if the infected source remains available.
- Update Windows, browsers, Office, document readers, and your security software.
- Run a full system scan and quarantine detected threats instead of manually deleting random files.
- Scan removable drives, shared folders, archives, and recent backups before opening files from them again.
- Replace damaged programs from trusted sources if executable files were modified.
- Keep clean personal files, but avoid restoring old installers, scripts, cracks, or unknown executable files.
- If detections keep returning after reboot, use an offline scan or a trusted second-opinion cleaner.
How to prevent computer viruses
- Keep Windows, browsers, Office, PDF readers, and security tools updated.
- Download software from official sources and avoid cracks, keygens, and fake “free premium” installers.
- Do not enable macros in unexpected documents.
- Use standard user accounts for daily work when possible.
- Keep real-time protection enabled and avoid running multiple real-time antivirus products at once.
- Back up important files with version history so one infected file cannot destroy every copy.
- Scan unknown files before opening them, especially archives, scripts, installers, and Office documents.
FAQ
Is every malware infection a computer virus?
No. A virus is one type of malware. Trojans, ransomware, spyware, adware, worms, and browser hijackers can all be malware without technically being viruses.
Can a computer virus spread through email?
Yes. Email attachments and links are common delivery methods, especially when the message pressures you to open an invoice, shared document, delivery notice, or urgent account warning.
Can a virus infect a USB drive?
Yes. Some infections use removable drives to spread shortcuts, hidden files, infected documents, or startup tricks. Scan unknown USB drives before opening files from them.
Should I delete every file an antivirus flags?
Not always. Quarantine is safer than manual deletion because it isolates the threat while allowing recovery if a file was falsely detected or needed for investigation.
What should I do if virus alerts keep coming back?
Repeated alerts usually mean persistence, an infected source file, a malicious startup entry, or reinfection from a browser, archive, or removable drive. Run a full scan, check startup and browser items, and use an offline or second-opinion scan if normal cleanup fails.
References
- NIST Computer Security Resource Center. “Virus.” NIST Glossary, accessed June 2, 2026. https://csrc.nist.gov/glossary/term/virus
- Microsoft Support. “Protect your PC from unwanted software.” Microsoft, accessed June 2, 2026. https://support.microsoft.com/en-us/windows/protect-your-pc-from-unwanted-software-074a2d74-02db-03dd-8340-9e1822377856
- Microsoft Support. “Microsoft resources and guidance for removal of malware and viruses.” Microsoft, accessed June 2, 2026. https://support.microsoft.com/en-us/topic/microsoft-resources-and-guidance-for-removal-of-malware-and-viruses-424a7d42-df47-4f9d-a98e-39082a5e9427
- Microsoft Support. “Antivirus and antimalware software: FAQ.” Microsoft, accessed June 2, 2026. https://support.microsoft.com/en-us/windows/antivirus-and-antimalware-software-faq-31f2a46e-fad6-b713-45cf-b9db579973e6
