What is Computer virus?

What is a computer virus?

A computer or PC virus is a piece of (usually) harmful software defined by two characteristics:

It needs to be initiated by an unsuspecting user. Triggering a virus can be as simple as opening a malicious email attachment (malspam), launching an infected program, or viewing an ad on a malicious site (adware). Once that happens, the virus tries to spread to other systems on the computer's network or in the user's list of contacts.
It must be self-replicating. If the software doesn't self-replicate, it's not a virus. This process of self-replication can happen by modifying or completely replacing other files on the user's system. Either way, the resulting file must show the same behavior as the original virus.
Computer viruses have been around for decades. In theory, the origin of “self-reproducing automata” (i.e. viruses) dates back to an article published by mathematician and polymath John von Neumann in the late 1940s. Early viruses occurred on pre-personal computer platforms in the 1970s. However, the history of modern viruses begins with a program called Elk Cloner, which started infecting Apple II systems in 1982. Disseminated via infected floppy disks, the virus itself was harmless, but it spread to all disks attached to a system. It spread so quickly that most cybersecurity experts consider it the first large-scale computer virus outbreak in history.

Early viruses like Elk Cloner were mostly designed as pranks. Their creators were in it for notoriety and bragging rights. However, by the early 1990s, adolescent mischief had evolved into harmful intent. PC users experienced an onslaught of viruses designed to destroy data, slow down system resources, and log keystrokes (also known as a keylogger). The need for countermeasures led to the development of the first antivirus software programs.

Early antivirus programs were exclusively reactive. They could only detect infections after they took place. Moreover, the first antivirus programs identified viruses by the relatively primitive technique of looking for their signature characteristics. For example, they might know there's a virus with a file name like “PCdestroy,” so if the antivirus program recognized that name, it would stop the threat. However, if the attacker changed the file name, the antivirus might not be as effective. While early antivirus software could also recognize specific digital fingerprints or patterns, such as code sequences in network traffic or known harmful instruction sequences, they were always playing catch up.

Early antiviruses using signature-based strategies could easily detect known viruses, but they were unable to detect new attacks. Instead, a new virus had to be isolated and analyzed to determine its signature, and subsequently added to the list of known viruses. The antivirus user had to regularly download an ever-growing database file consisting of hundreds of thousands of signatures. Even so, new viruses that got out ahead of database updates left a significant percentage of devices unprotected. The result was a constant race to keep up with the evolving landscape of threats as new viruses were created and released into the wild.

Current status of computer viruses and antivirus programs

PC viruses today are more of a legacy threat than an ongoing risk to computer users. They've been around for decades and have not substantially changed.

So if computer viruses aren't really a thing anymore, why do people still call their threat protection software an antivirus program?

It boils down to entrenched name recognition. Viruses made sensational headlines in the 90s, and security companies began using it as shorthand for cyberthreats in general. Thus, the term “antivirus” was born. Decades later, many security firms still use the term “antivirus” to market their products. It's become a vicious cycle. Consumers assume viruses are synonymous with cyberthreats, so companies call their cybersecurity products “antivirus” software, which leads consumers to think viruses are still the problem.

But here's the thing. While “virus” and “antivirus” are not exactly anachronisms, modern cyberthreats are often much worse than their viral predecessors. They hide deeper in our computer systems and are more adept at evading detection. The quaint viruses of yesterday have given rise to an entire rogue's gallery of advanced threats like spyware, rootkits, Trojans, exploits, and ransomware, to name a few.

As these new attack categories emerged and evolved beyond early viruses, antivirus companies continued their mission against these new threats. However, antivirus companies were unsure how to categorize themselves. Should they continue to market their products as an “antivirus” at the risk of sounding reductive? Should they use another “anti-threat” term to market themselves under like “anti-spyware,” for example? Or was it a better to take an all-inclusive approach, and combine everything in a single product line that addressed all threats? The answers to these questions depends on the antivirus company.

At Malwarebytes, cybersecurity is our highest-level catchall category. And that's why it makes sense to combine our anti-threat effort into a single term that covers more than just viruses. Accordingly, the term we use to cover most of what we do is “anti-malware,” which is short for “anti-malicious software.”