The Quiet Parasite: What A Computer Virus Actually Does

You double-click a file, and for a moment nothing seems to happen. The screen stays the same. The fan hums. You move on with your day. But inside the machine, a tiny piece of code has just copied itself into another program, then another, like a message passed between strangers in a crowded room. By the time you notice something is wrong - a file won't open, the system feels sluggish - the virus has already done its work.

The word "virus" borrows from biology for a reason. Both are small, self-replicating, and depend on a host to survive. A biological virus hijacks a cell's machinery to make copies of itself. A computer virus hijacks a program's code to do the same. The difference is that the digital version was written by a person, with a purpose, and that purpose is rarely benign.

Most people know a virus is bad news. Fewer know what it actually does inside the machine. The answer is not one thing but many, and the variety is what makes them hard to categorise - and harder to stop.

The Hitchhiker That Rewrites The Map

A computer virus is not a standalone program. It is a fragment of code that attaches itself to something else - a spreadsheet, a game, a system utility. The technical term is "host file." Without a host, a virus cannot run or spread. This is what separates it from a worm, which is self-contained and travels across networks on its own.

When you open the infected host, the virus executes first. It inserts its own instructions into the program's normal flow, then hands control back to the original file so that nothing looks unusual. The user sees the spreadsheet open as expected. The virus sees an opportunity to find another file to infect.

The replication is not random. Many viruses target executable files - files ending in.exe or.com on Windows systems - because those are programs that run automatically. Others infect scripting languages inside documents, such as macros in Microsoft Office. Once a virus has found a new host, it writes its code into that file and waits for the next double-click.

The Trigger That Waits For The Right Moment

Not every virus activates immediately. Some are programmed to lie still, like a seed in dry soil, until a specific condition is met. The trigger might be a date, a system event, or a user action. This is called a "logic bomb," and it is a common feature of viruses designed for maximum damage.

The most famous example is the CIH virus, also known as Chernobyl, which activated on April 26, 1999 - the anniversary of the nuclear disaster. On that date, it overwrote critical system data on infected machines, rendering them unbootable. The trigger was a date. Other viruses wait for a file to be opened a certain number of times, or for the system clock to hit a particular hour.

Delayed activation serves two purposes. It gives the virus time to spread before anyone notices. It also makes detection harder, because the infected system behaves normally until the trigger fires. By the time the bomb goes off, the virus has already copied itself onto dozens of machines.

The Damage That Takes Many Shapes

Once a virus is active, what it does depends entirely on what its author programmed it to do. The range is wide. Some viruses delete files or corrupt data. Some steal passwords, credit card numbers, or personal documents. Some encrypt files and demand a ransom for the decryption key - a tactic called ransomware that often arrives via a virus.

Others are subtler. A virus might install software that records keystrokes, called a keylogger, and sends the logs to a remote server. It might turn the infected machine into part of a botnet, a network of compromised computers used to attack other systems. The user may never notice, except for a gradual slowdown as the virus consumes processor cycles and memory.

The damage is not always permanent, but it is often expensive. A 2023 report from IBM put the average cost of a data breach at $4.45 million. Not all breaches involve viruses, but many do. The cost includes lost data, downtime, forensic investigation, and reputational harm. A virus does not need to be sophisticated to be costly.

The Tricks That Hide The Intruder

Antivirus software works by looking for known patterns - signatures - in code. A virus that always looks the same is easy to catch. So modern viruses change their appearance. This is called polymorphism.

A polymorphic virus includes a mutation engine that alters its own code each time it replicates. The core function stays the same, but the sequence of instructions changes. Two copies of the same virus can look completely different to a scanner. The antivirus must recognise what the virus does, not what it looks like, which is a harder problem.

Other viruses use rootkit techniques to hide their presence. A rootkit modifies the operating system itself, intercepting system calls so that the virus's files and processes are invisible to the user and to most security tools. You can run a file manager and see no sign of the infection. The virus is there, but the system lies about what it sees.

These techniques do not make a virus invincible, but they raise the bar. Antivirus software has evolved to use behavioural detection - watching what a program does rather than what it looks like. The cat-and-mouse game continues.

The Host That Cannot Be Cured

A virus attaches to a host file, and that attachment is permanent unless the virus code is surgically removed. Cleaning an infected file is possible, but it is not always safe. Removing the virus can break the host program, leaving it unusable. In many cases, the safest response is to delete the infected file and reinstall the software from a clean source.

This is why prevention matters more than cure. Keeping software updated closes the vulnerabilities that viruses exploit. Avoiding unknown attachments and downloads reduces the chance of encountering a host file that carries a virus. A good backup strategy means that even if a virus destroys data, the loss is temporary.

The honest caveat is that no system is perfectly secure. A determined attacker with a zero-day exploit - a vulnerability that no one knows about yet - can bypass most defences. The goal is not invulnerability. It is making the attack expensive enough that the attacker moves on to an easier target.

Wrapping Up With A Light Touch

A computer virus is a piece of code written by a person, for a purpose, that happens to spread by borrowing other programs. It is not magic, not alive, and not invincible. It is a small machine that does exactly what its builder told it to do. The unsettling part is not how clever the virus is. It is how ordinary the host file looks before you click.