What Is Virus?

A virus is malicious code that replicates by inserting itself into other files or programs, requiring a user to run the infected host for it to spread. It is the oldest malware category and the term most commonly used to mean malware in general.

Strictly defined, very little modern malware is a virus. Attackers have better distribution methods than file infection, and the category survives mainly in product names and casual speech.

Why file infection fell out of use

It is inefficient. Infecting executables spreads only as fast as people share files, and it leaves modifications that integrity checking and signature verification detect readily.

Networks, email and the web offer far faster distribution with less to detect. Code signing made modification of legitimate executables conspicuous, and operating system protections made writing to program directories difficult.

The variant that is very much alive

Document macros. Code embedded in a spreadsheet or document, executed when the file is opened and macros are enabled, spreading because people forward attachments in the ordinary course of work.

It persists because the functionality is legitimate and widely relied upon, particularly in finance and operations. Blocking macros in documents originating from the internet closes most of it, and is now a default worth confirming rather than assuming.

Why the terminology still matters

It matters for expectations. Antivirus products were designed around file scanning, and a great many organisations still treat their presence as sufficient endpoint protection.

Current intrusions frequently involve no malicious file, so file scanning finds nothing to report. Understanding that a clean antivirus console is not evidence of a clean environment is the practical value of the distinction. See fileless malware.

Boot and firmware-level variants

Code infecting boot sectors or firmware persists below the operating system, survives reinstallation and is largely invisible to tooling running on the infected system.

Secure boot and signed firmware address most of this, and it remains relevant for older equipment and for targeted attacks where the effort is justified. See rootkit for how that concealment works.

Removable media, which never entirely went away

Infected drives remain a delivery route, particularly into isolated environments where they are the only way data moves. Industrial and clinical environments frequently depend on them for exactly that reason.

Controls: disable autorun, restrict which devices may connect, and provide a sanctioned scanning station for media entering a sensitive environment, since prohibition alone tends to produce workarounds.

The terminology in contracts and policy

Requirements written as antivirus software shall be installed appear throughout policies, contracts and compliance questionnaires, and they describe a control that was adequate two decades ago.

Where that language exists, it is worth restating as a capability requirement — behavioural detection, response capability, central management, coverage reporting — rather than a product category. Otherwise an organisation can satisfy the clause completely while having no meaningful endpoint detection at all.

Where to start

Confirm that macros are blocked by default in documents arriving from outside your organisation. It is a single policy setting and it closes the one live variant of this category.

See endpoint security. GuardsArm delivers managed detection and response.