What is a virus?
In everyday speech "virus" means any malware, but on the A+ exam it has a narrower meaning. A virus is malicious code that inserts itself into a host, such as an executable program, a document with macros or the boot code on a disk, and runs when that host runs. Once running, it can deliver a payload (corrupting files, opening a backdoor, displaying messages) and copy itself into other files or disks. The defining traits are a host and a trigger: a virus needs someone to run an infected file or boot from an infected disk. That is why viruses spread through shared files, email attachments and removable media.
How a virus spreads
- A user runs an infected program, opens an infected document and enables its macros, or starts the computer from an infected disk.
- The virus code runs along with, or before, the legitimate code.
- It infects other files, documents or drives it can reach.
- The cycle repeats when someone shares or runs those infected copies.
Common types
- File infector: attaches to executable files and runs whenever the program starts.
- Macro virus: lives inside documents and runs through the application's macro language. This is one reason organizations keep Office macros disabled by default.
- Boot sector virus: infects the boot code at the start of a disk (historically the master boot record) so it loads before the operating system and before most security tools. Symptoms can include boot loops, "operating system not found" errors or failures right after POST. Secure Boot on UEFI systems reduces this risk by refusing boot code that is not signed by a trusted key.
Signs of infection
- Files that change size, become corrupted or stop opening
- Programs that crash, and system files that fail integrity checks such as
sfc /scannow - Boot problems that appear before Windows loads
- Security software that has been turned off or cannot update
- Antivirus alerts on files from a shared drive or USB stick
Failing drives and bad updates cause some of the same symptoms, so confirm with a scan before you rebuild anything.
Detection and removal
- Signature-based detection compares files against a database of known malware patterns, so definitions must be updated before scanning.
- Heuristic and behavior-based detection flags code that acts like malware, which helps catch new variants that have no signature yet.
- If the virus interferes with Windows, scan from Safe Mode or run an offline scan, such as Microsoft Defender Offline, which checks the disk from outside the infected installation.
- A boot sector infection may require repairing the boot code from the recovery environment, or reimaging.
- Follow the malware removal procedure: verify the symptoms, quarantine the system, disable System Restore, remediate, schedule scans and updates, re-enable System Restore and educate the user. Also scan the USB drives and shares the user touched, or the virus comes right back.
Virus vs. worm vs. trojan
| Type | Needs a host file? | How it spreads | Needs user action? |
|---|---|---|---|
| Virus | Yes | Copies itself into other files or disks when the host runs | Yes, someone runs the host or boots the disk |
| Worm | No, standalone | Copies itself across networks, often by exploiting unpatched services | No |
| Trojan | No, standalone | Does not self-replicate; the user installs it because it looks legitimate | Yes, the user installs or runs it |
Virus on the CompTIA A+ exam
Viruses, including boot sector viruses, are among the malware types in Core 2 (220-1202) objective 2.4. Know the host-plus-user-action definition and how it separates a virus from a worm and a trojan. If a question describes malware that spread through infected files on a shared USB drive when coworkers opened them, think virus. If it spread across the network with no one clicking anything, think worm. If the problem starts before the operating system loads, consider a boot sector virus along with boot order and disk failure. Also know the difference between signature and heuristic detection and why definitions must be current.