What Computer Viruses Are, How They Work, and the Best Ways to Protect Against Them

UPI Study › Courses › Ethics in Technology › Free lessons › Lesson 9.4 Free with a free account

What Computer Viruses Are, How They Work, and the Best Ways to Protect Against Them

Ethics in Technology · Chapter 9: Data Breaches, Digital Infections, and the Malware EcosystemSection 9.4 · lesson 45 of 11614 min · free with a free account

← What Companies and Individuals Face Legally After a Data Breach OccursNext lesson: How Computer Viruses Became Global Threats →

Earn 3 college credits for Ethics in TechnologyRecommended for credit by NCCRS · Computer Science 195 · self-paced · one payment, lifetime access
Enroll in Ethics in Technology · $250 →Download the syllabus (PDF)

In this lesson

Understand host-dependent replication, delayed effects, and protections across the infection chain.

  • Define a virus through host attachment and replication.
  • Explain infection, optional triggers, and optional payloads.
  • Interpret the four-phase teaching model and quiet infections.
  • Map preventive controls and tested recovery to different stages.

Free study notes

Get this lesson's notes by email

The key points and 4 practice questions with answers, in your inbox. One email, free.

One email. Unsubscribe in one click.

Transcript

Everything said in the video, section by section (1,663 words). Read along, or search it.

Chapter 9

Computer Viruses and Prevention

The word virus often means any unwanted software in everyday conversation. Technically, it describes replication through infection of a host program or suitable file. That infected host must execute relevant code before the virus becomes active. Execution can follow a person's action, startup, automation, or application behavior. We distinguish the essential infection mechanism from an optional trigger and payload. A program that only replicates can still alter files and consume resources. The four-phase teaching model connects dormancy, propagation, triggering, and payload execution. Quiet infections can lack obvious symptoms, while stored code may still be detected. The infection chain connects delivery, execution, host changes, transfer, and possible effects. Different controls reduce different opportunities, and tested recovery addresses damage that prevention did not stop. Informed decisions, early reporting, and complementary technical safeguards all contribute to responsible protection.

Precise Definition

A Virus Replicates by Becoming Part of a Host

A virus replicates by inserting copies into other programs or suitable files. It relies on execution of infected host code to become active. The host can be an executable program, document instructions, or an affected startup disk region. Infection means placing a copy into a new suitable host. A payload is activity beyond replication, including disruption, theft, or a message. A person may run an infected program or enable document instructions. Startup or automation can also invoke a host; a fresh deliberate click is not always necessary. Opening an ordinary file or inserting a drive does not necessarily execute malicious code. Malware is the broader category, rather than a synonym for virus. Worms are self-contained replicators, while Trojans present deceptive apparent functionality; behaviors can combine. The actual mechanism determines which safeguards are useful, regardless of the casual label given to it.

Host and Execution

Carrying an Infected Host Is Different from Executing It

An infected host carries code, but carrying that file is different from executing it. When the infected program is invoked, relevant virus code can become active. A document infection depends on the application executing its applicable infected macro or script content. An affected startup region can run through the machine's boot process. These examples describe execution events, without claiming that every document or drive automatically runs a virus. An unused infected copy may remain inactive until relevant execution occurs. It may still be found by inspecting its stored contents or unauthorized changes. A transfer can carry an infected host to another place without activating it immediately. Backups can also preserve infected hosts for later accidental reintroduction. Do not run a suspicious sample merely to test whether it is dangerous. Use the approved reporting process, which supports safe investigation without creating an unnecessary execution opportunity.

Components

Replication Is Essential; a Separate Trigger and Payload Are Optional

The infection mechanism locates a suitable host and inserts a copy into it. It arranges for relevant host execution to activate the virus. Replication through host infection is essential to the virus definition. A separate trigger is a condition controlling when a payload acts. Examples include a date, an infection count, or an application event. A separate delayed trigger is optional; activity may happen immediately. The payload performs an effect beyond spreading, such as deletion, encryption, theft, or resource consumption. A message can also be a payload, without proving that all other effects are harmless. A virus does not need a separate payload to meet the definition. Actual software may combine behaviors, so assess its available capabilities and consequences. Controls that restrict unauthorized host modification or execution address the infection mechanism rather than guessing one payload date.

No Destructive Payload

Unauthorized Replication Still Alters the System

Copying alone can consume storage and processing resources, even without a distinct destructive payload. Unauthorized host changes also affect file integrity and confidence in trusted code. A host may appear to work while carrying a modification its owner did not authorize. An imperfect infection can corrupt or disable the host. The severity depends on implementation, reach, resources, and the importance of affected systems. No separate deletion routine is needed to make unauthorized replication worth addressing. Spread and payload are useful separate concepts, but their actual behaviors can interact. A payload that changes system availability can also affect opportunities for further propagation. Ask which hosts are reachable, what activates the code, and what the program does beyond replication. The label does not establish speed, severity, or every capability. A quiet or harmless-looking presentation is not evidence that the system remains in an authorized, trusted state.

Life Cycle Teaching Model

Dormancy, Propagation, Triggering, and Payload Execution

The source presents four phases as a teaching model for the virus life cycle. Dormancy means code is present but inactive or waiting, without a meaningful quiet interval in every virus. Propagation places copies into other suitable hosts. Those copies may support additional replication when their relevant execution occurs. Triggering satisfies an applicable condition for a separate payload, when one exists. Execution then carries out that payload's effects, which may become visible. This is not a mandatory, identical schedule for every virus. New copies need not begin with a long dormant interval. Replication and payload activities may repeat, overlap, or happen immediately. Detection may occur before visible effects, through file inspection or prevention of execution. Investigate the exposure and transferred copies without waiting for the final phase to announce itself.

Dormancy and Discovery

Quiet Activity Reduces Symptoms, but Does Not Make Code Undetectable

A quiet infection may produce no obvious deletion, message, or unusual resource spike. That reduces clues available to someone watching visible symptoms. It does not make stored infected code universally undetectable. File inspection may recognize known patterns or unauthorized changes before the code runs. Runtime monitoring may have fewer clues while the code is inactive. Later execution and behavior can provide additional evidence. Logs, copies, and trusted comparisons may help establish when exposure began. Detection results depend on the code, visibility, controls, and inspection methods. There is no supported universal rule that discovery almost always waits until payload execution. Investigate possible infection time and discovery time; both can matter for response and required reporting. Earlier backups may contain infected hosts, but not every backup taken during an interval is automatically contaminated.

Chain of Infection

Match Safeguards to the Route and Stage They Address

The teaching chain begins when an infected host arrives through some delivery route. Relevant execution activates code, which may attach copies to other hosts. Transferred infected copies can then create further opportunities elsewhere. A separate payload may act, but is optional, and actual stages can overlap. Mail filtering and appropriate restrictions reduce selected risky deliveries. Patching, execution controls, and informed decisions reduce unauthorized activation opportunities. Limited authority restricts reachable host changes, while controlled transfer routes reduce movement of copies. Protected recovery material supports restoration rather than preventing the initial infection. Stopping a required step can interrupt a particular route. Complementary controls address alternative routes and reduce dependence on a single safeguard succeeding. No universal infection percentage or fixed spread speed is needed to explain why those protections work together.

Delivery and Execution

Reduce Arrival, Unsafe Activation, and Known Weaknesses

Maintain updates for operating systems and applications, addressing known vulnerabilities relevant to the environment. Test and verify deployment rather than assuming an available patch was installed everywhere. Application weaknesses can create execution opportunities beyond a person's deliberate choice. Maintain protective software with suitable coverage, configuration, updates, and a working response process. Products can use signatures, behavior, and other methods beyond exact recognition of previously known files. They still do not guarantee detection of every new threat or unsafe action. Mail and file restrictions reduce selected delivery routes, with appropriate handling of legitimate exceptions. Attachments, downloads, and unexpected requests deserve deliberate decisions under the approved workflow. Verify suspicious requests through an established trusted channel, rather than the suspicious message's own instructions. People need useful guidance and clear reporting, without personally executing a suspicious file to investigate. User caution and technical controls address different opportunities and should support one another.

Attachment and Transfer

Limit Authority and the Routes That Carry Infected Copies

Use limited authority for ordinary work, reducing reach into protected programs and other users' resources. Routine administrative access can give accidentally executed code broader opportunities. User-accessible documents and permitted actions can still suffer serious harm. Permission flaws or privilege escalation may expand reach, so least privilege is not universal confinement. Control removable media as both an arrival route and a transfer route. It can bypass network inspection, while approved media still needs appropriate handling and inspection. Segment and restrict network paths to limit selected movement opportunities. Shared services, credentials, allowed transfers, or removable devices can cross poorly controlled boundaries. Spread may accelerate when new hosts can reach additional suitable hosts. Finite targets, access restrictions, transfer frequency, and containment affect that growth. Segmentation reduces particular routes; it does not guarantee that every outbreak stays within exactly one department.

Recovery and Backup Safety

Protected Copies Must Be Usable, Clean, and Tested

Protected backups support recovery when prevention does not stop damage. Offline or suitably isolated copies reduce the attacker's ability to erase or encrypt recovery material. Retention and versions can preserve earlier points when recent copies contain infected hosts. Protect access and keys while keeping the material usable by authorized responders. Test availability, integrity, dependencies, and the real restore process. A backup that has never been restored leaves important assumptions unverified. Offline status does not prove that an already infected copy is clean. Contain and eradicate appropriately, or rebuild, before restoring and reconnecting systems. Take care that recovery does not reintroduce the malware into clean systems. Known-good copies cannot reverse theft, all downtime, or every other harm beyond their recovery coverage. Containment, revocation, eradication, and rebuilding remain useful after compromise; backups are not the only remaining defense.

People, Layers, and Review

Make Early Reporting Part of a Practical Defense

Informed people are part of a defense supported by useful technical controls. Teach relevant attachment and execution risks, and provide a clear route for suspicions or mistakes. A blame-focused response can discourage reporting; supportive guidance helps people report sooner. Do not assume every person hides mistakes or every infection requires a fresh click. The virus definition centers on host infection and replication, with execution activating relevant code. The infection mechanism is essential; a separate trigger and payload are optional. Dormancy can reduce visible clues while file inspection may still detect stored malicious code. Short-term symptoms alone do not describe the full infection history or every transferred copy. Patching, protective software, authority limits, and transfer controls address complementary opportunities. Recovery uses protected, tested, known-good material alongside containment and appropriate cleanup or rebuilding. Apply these purposes to the actual route and environment, rather than treating one product or fixed sequence as guaranteed safety.

About Ethics in Technology at UPI Study

Ethics in Technology (Computer Science 195) is a self-paced online course of 116 video lessons in 15 chapters, from cybersecurity basics, privacy and surveillance to big data, hacking, malware, network defense, intellectual property, cybercrime, encryption, emerging technology and digital citizenship. It carries a NCCRS credit recommendation for 3 semester credits.

Every lesson transcript is free on pages like this one, and the videos are free with a free UPI Study account. Enrolling adds a practice quiz after each lesson, the graded work and final exam that earn the credit, lifetime access, and an official transcript on completion. UPI Study has helped over 130,000 students with college credits. ACE and NCCRS have over 2,100 cooperating colleges that will consider accepting credits; the final decision is with the universities.

Enroll now → Course details Download the syllabus All Computer Science courses

Compare: Cybersecurity vs Ethics in Technology · Which ethics course?

Why take it here

Why students take Ethics in Technology with UPI Study

The right and wrong of the digital worldEthics in Technology looks at the choices technology forces on people and organizations: security and privacy, surveillance and the law, big data, hacking and cyber warfare, malware and breaches, intellectual property, cybercrime, encryption, artificial intelligence and responsible digital citizenship. It suits computer science, information technology and business degrees.
Credit at a fraction of the priceThe same 3 credits can cost $750 or more at a US college. Here it is one payment, self-paced, with lifetime access.
Finish your degree soonerTransfer credits reduce the courses you still owe, so you can graduate earlier or lighten a heavy semester.
Strengthen an applicationA completed college-level course on an official transcript shows admissions and scholarship committees you can do the work.
Study on your own scheduleNo start dates, no deadlines. Watch the lessons, practice, and take the final when you are ready.
130,000+students helped with college creditsACE and NCCRS have over 2,100 cooperating colleges that will consider accepting credits; the final decision is with the universities.

Where the credit goes

Universities that work with NCCRS

Ethics in Technology carries a NCCRS credit recommendation. These universities work with NCCRS; some are UPI Study's signed partners. ACE and NCCRS have over 2,100 cooperating colleges that will consider accepting credits; the final decision is with the universities.

Thomas Edison State UniversityThomas Edison State UniversitySigned partnerUniversity of the PeopleUniversity of the PeopleSigned partnerCharter Oak State CollegeCharter Oak State CollegeSigned partnerStrayer UniversityStrayer UniversitySigned partnerColumbia Southern UniversityColumbia Southern UniversitySigned partnerIndiana TechIndiana TechSigned partnerPenn StatePenn StateWorks with NCCRSSouthern New Hampshire UniversitySouthern New Hampshire UniversityWorks with NCCRSSUNYSUNYWorks with NCCRS +many more cooperating universitiesFind my college →

Find my college → Not listed? Ask Athena in the corner of this page, or book a 15-minute call.

FAQ

Questions students ask us

About What Computer Viruses Are, How They Work, and the Best Ways to Protect Against Them

What is a computer virus?
A computer virus is malicious code that replicates by inserting copies of itself into other programs, documents with macros or boot regions, which then act as hosts. It becomes active only when infected host code runs, whether a person launches a program, enables a macro, or the computer starts up. Simply storing or copying an infected file does not activate it. Damage beyond copying, called the payload, is optional.
Is all malware a virus?
No, malware is the broad category of harmful software, and a virus is one type that spreads by infecting host files or programs. A worm is self-contained and can spread on its own, often across networks. A Trojan pretends to be useful or harmless while hiding another function and does not necessarily replicate. Real malware often combines these behaviors, so the actual mechanism determines which defenses help.
What are the four phases of a computer virus?
The common teaching model lists four phases: dormant, when code is present but inactive; propagation, when it copies itself into other hosts; triggering, when a condition such as a date or event activates a payload; and execution, when the payload acts, for example deleting or encrypting files. It is a model, not a fixed schedule; phases can overlap or happen immediately, and some viruses have no separate trigger or payload.
How can you protect a computer from viruses?
Layered habits work best. Keep operating systems and applications patched and confirm updates installed, run maintained protective software, and think before opening unexpected attachments or enabling macros, verifying odd requests through a trusted channel. Use a standard rather than administrator account for daily work, control removable drives, and segment networks. Keep offline or isolated backups and test restoring them, since prevention can fail. Never run a suspicious file to test it.

About the Ethics in Technology course

How many college credits is Ethics in Technology?
Ethics in Technology (Computer Science 195) carries a NCCRS credit recommendation for 3 semester credits. ACE and NCCRS have over 2,100 cooperating colleges that will consider accepting credits; the final decision is with the universities.
How much does Ethics in Technology cost and what is included?
$250, paid once, with lifetime access: all 116 video lessons, a practice quiz after each, the graded work and final exam, and an official transcript when you finish. It is sold on its own and is not part of UPI Study PRO.
Which universities accept UPI Study credits?
UPI Study has signed partner agreements with universities such as Thomas Edison State University, University of the People and Charter Oak State College, and works with universities such as Penn State, SNHU and SUNY. ACE and NCCRS have over 2,100 cooperating colleges that will consider accepting credits; the final decision is with the universities. Use "Find my college" on this page to check yours.
How long does Ethics in Technology take?
It is self-paced with no deadlines. The 116 lessons total about 28 hours of video; most students add reading and practice time and finish in a few weeks to a few months, on their own schedule.
How are the exams done?
Quizzes and assignments are online in the course. The final exam is taken online with proctoring; a person on the UPI Study team checks assignments, usually within two days.
How do my credits reach my college?
When the course shows 100% complete, request the official transcript from your dashboard. It is sent to the college you name, and you can send it to more than one. Check your college first with "Find my college" on this page, or ask Athena.

Ready for the full course? Earn 3 credits in Ethics in Technology.

116 video lessons, a quiz after each one, and the graded work that earns the credit. Recommended for credit by NCCRS.

Enroll in Ethics in Technology →Download the syllabus
Ethics in Technology
3 credits · NCCRSEnroll →