Computer virus
In security, a computer virus is malicious code that reproduces by inserting a copy of itself into another program, document or boot sector, so it needs a host and needs something or someone to run it. It is one category of malware rather than a synonym for it, because most of today’s attacks do not spread that way.
How it works
A virus has three parts: the way in, the reproduction mechanism, and the payload it runs. The middle one is what defines it. On execution it looks for other files it can append its own code to and modifies them, so each of those becomes a carrier in turn. Without that host there is no virus: it is code that travels inside something the victim wants to open.
The historical families are told apart by where they lodge. File infectors write inside executables. Boot sector viruses sit in the part of the disk the machine reads before it loads the operating system, so they run before any defence does. Macro viruses live in office documents and exploit the fact that those formats allow code to be stored alongside data. Polymorphic viruses change their own form in every copy so that no two copies share a signature, which is the direct answer to detection built on recognising the file.
Three words are used interchangeably and are not the same thing. A virus reproduces inside a host. A worm propagates by itself, across the network, with nobody opening anything. A trojan does not reproduce at all: it pretends to be something else so that you run it. The distinction is not academic, because it changes containment: against a worm the problem is the network, against a virus it is the inventory of infected files, and against a trojan it is how it was delivered.
Why the word barely appears in a report
The term survives in everyday language and in the name of the antivirus product, but not in the taxonomy the work uses. What turns up in the intrusions being investigated today is ransomware, infostealers, loaders, remote access tools and wipers. Those categories are defined by what the code does rather than by how it reproduces, which is why they are the ones you can decide anything with.
There are two structural reasons. The first is that much of the activity no longer needs a file: it runs in memory or straight through signed system utilities, so there is nothing to recognise. The second is that the attacker often needs no malicious code at all, because they arrive with valid credentials. Operational frameworks such as MITRE ATT&CK classify by technique rather than by malware family for exactly this reason.
The practical consequence is that asking whether there is a virus is almost never the useful question. These are: what got in, how, what did it take, and what else did it install. That is the difference between deleting a file and running an incident response.
What is not a virus
A virus hoax is a message warning of an infection that does not exist, asking you to forward it to all your contacts or to delete a system file that turns out to be legitimate. There is no code and there is no infection: the propagation mechanism is you. It resembles phishing in its wrapper and differs in its objective, because phishing is after credentials or money and a hoax only wants to circulate.
Nor is almost anything habitually blamed on a virus actually one: a slow machine, a browser with a changed home page, pop-up advertising, or an antivirus alert that turns out to be a false positive. It could be unauthorised mining, unwanted software that arrived bundled with something else, or nothing. Starting from the name instead of from what was observed is what loses the first hour.
What to do if you suspect an infection
Isolate the machine from the network and do not power it off, because a good part of what could still be established lives in memory and goes with the power. The single exception is an encryption run in progress: there, pulling the power stops being a bad idea and becomes the only thing that stops the damage.
Do not delete and move on. Removing the file answers neither how it arrived, nor what credentials it took, nor what else it installed, and those three answers are what decide whether it happens again tomorrow. Write down the time and what you were doing: that timestamp is what makes it possible to search the telemetry of an EDR or a SIEM.
Change the passwords from another device and revoke the open sessions, not just the passwords: a stolen session cookie still works after a password change. If a restore is needed, take it from a copy the compromised machine could neither reach nor modify, which is the whole point of an immutable backup. And tell whoever handles incidents in your organisation before cleaning anything, because cleaning destroys the evidence that person needs.
Where this shows up in an audit
We do not release viruses on a client network, and the reason is not only legal: a virus reproduces on its own and an exercise has to be reversible. What we do measure is the other half of the problem. On an internal test we behave like an operator with tooling written for that client and never seen by anyone, so any detection that fires is detecting behaviour rather than recognising a known sample: that is the honest test of an endpoint control. We record every artefact we place and hand back the full list so nothing of ours is left behind. It is part of what an attack from inside the network actually measures.