Chapter 3 — Computer Virus

Introduction: A computer virus is a type of malicious program that attaches itself to other files or programs and executes when the host is run. Unlike harmless programs, a virus is created to change the normal behaviour of a computer, often without the user’s knowledge.

How viruses attach and run: A virus usually hides inside a host file which could be a program, a document with macros, or system files. When a user opens the host file or runs the host program, the virus code also runs. The virus then tries to make copies of itself and attach those copies to other files or send them to other computers.

Purpose and effects: The purpose of a virus can vary. Some are made to annoy users by showing messages, others are designed to delete or corrupt files, slow down a computer, display unwanted adverts, or even steal personal information. The effect depends on the virus author’s intention and the type of data or programs the virus touches.

Dependence on user actions: Many viruses need a human action to spread, such as opening an attachment, running an installer, or inserting an infected removable drive. This means that simple care and attention from users can often prevent infections.

Difference from other threats: The word 'virus' is often used broadly but other related threats exist: worms, Trojans and spyware. A worm can spread itself automatically over networks, a Trojan hides as a useful program while performing bad actions, and spyware watches user activity. Learning the exact behaviour helps in choosing the correct defence.

Summary: In short, a computer virus is a self-replicating piece of malicious code that needs a host to spread and can harm data, privacy and system performance. Recognising how it hides and runs is the first step to protecting a computer.

Overview of types: Viruses come in many forms. Each type works in a different way and targets different parts of a computer. Knowing the types helps students understand signs and choose the right protection.

File infector viruses: These attach to executable files (programs). When the program is run, the virus executes and searches for other programs to infect. They often remain hidden until the program runs, and they spread when infected programs are copied or shared.

Boot sector viruses: These infect the area of a disk used to start a computer. If the boot sector is infected, the virus starts even before the operating system loads. This can make removal harder and may require special tools or reinstalling the system.

Macro viruses: Macro viruses are embedded in documents that use macros, for example word processors or spreadsheets. When the document is opened and macros run, the virus executes its commands. Because students often share document templates, macro viruses can spread quickly in a class.

Polymorphic and stealth viruses: Polymorphic viruses change their code slightly each time they infect to avoid signature detection. Stealth viruses hide their presence by falsifying file sizes or masking their activity. Both types are designed to resist simple detection methods.

Companion viruses and multipartite viruses: Companion viruses create new programs that run instead of the intended program, while multipartite viruses can infect both files and the boot sector, spreading in multiple ways and making removal more complex.

Worms and Trojans (related threats): Worms spread across networks by themselves and may cause widespread damage quickly. Trojans hide as useful programs but perform harmful actions when run. Both are often discussed with viruses because they also harm systems, but their spreading methods differ.

Classroom relevance: For students, macro viruses and file infectors are most common in shared schoolwork. Learning these types helps in choosing safe habits like disabling macros or scanning attachments before opening.

Introduction: Viruses spread when the code moves from an infected host to other files, devices or systems. Studying the common paths helps students take practical steps to stop spread and protect their own work.

Removable storage: USB flash drives, external hard disks, memory cards and CDs are frequent carriers. When infected files are saved to a removable device and then that device is connected to another computer, the virus can copy itself to the new system. Many infections start this way because people move files between home and school machines.

Email and messages: Email attachments are a very common route. A virus can be sent as a document, compressed file, or program attached to an email. If a recipient opens the attachment, the virus may run. Instant messaging and chat apps with file transfer also carry similar risks.

Internet downloads: Downloading software, games, media or documents from untrusted websites can introduce viruses. Files may come bundled with unwanted code. Peer-to-peer networks and unofficial sources are particularly risky because there is no guarantee of what you will receive.

Network sharing: On shared school networks or home networks, viruses can spread through shared folders and printers. If one computer saves an infected file in a shared location, others who access the same folder may pick up the virus.

Software vulnerabilities: Some viruses exploit bugs in operating systems or applications to enter a computer without user action. These exploit-based infections often spread quickly if many machines use the same vulnerable software and have not been patched.

Social engineering: Attackers often trick users into running viruses by sending convincing-looking messages, fake software updates, or attachments that promise homework answers. Human behaviour is a major factor in spread; awareness reduces risk.

Summary: Viruses spread through removable media, emails, unsafe downloads, network sharing, security vulnerabilities and human tricks. Avoiding risky sources and using scanning tools helps break the chain of infection.

Overview: A computer that has been infected may show many different signs. Some are obvious, while others are subtle. Not every problem means a virus; hardware issues, outdated software or lack of storage can cause similar symptoms. Still, knowing common signs helps decide when to investigate further.

Slow performance and crashes: One common symptom is sudden slowdown. The computer may take longer to open programs, respond to clicks, or boot. Frequent freezing or unexpected restarts and crashes can also indicate that a malicious program is running in the background using system resources.

Unexpected messages and pop-ups: If many pop-up ads appear, or unfamiliar warning messages show up even without internet browsing, malware might be present. Some adware creates persistent pop-ups and new toolbars in browsers that the user did not install.

Altered or missing files: Viruses often change files by corrupting them, changing extensions, or encrypting them (as with ransomware). If documents cannot be opened or their contents have changed, this could signal infection.

Programs opening or closing automatically: If applications start on their own, or if unknown programs run in the background, malware may be executing without permission. Check the list of running programs in the task manager for unfamiliar items.

Disabled security tools: Some viruses try to disable antivirus software or block updates so they remain hidden. If security programs stop working suddenly, investigate promptly.

Unusual network activity: Malware that sends data or communicates with remote servers will cause unexplained internet usage. If the network indicator is active while you are idle, or your data plan is used rapidly, there may be a program transmitting information.

Strange emails or messages sent from your account: If your contacts receive messages or attachments you did not send, malware may be using your account to spread. Inform contacts and change passwords after cleaning the infection.

Conclusion: Watch for these signs and act quickly. A careful check with updated antivirus and consultation with a teacher or technician will help determine whether the cause is a virus or another issue.

Purpose and role: Antivirus software is designed to find, remove and prevent malware infections. It acts as a barrier, scanning files and monitoring activity to stop harmful code from running. For students, antivirus helps protect homework, projects and personal data.

Signature-based detection: One main method is signature-based detection. Antivirus vendors analyse malware to extract a unique pattern, or signature, from the malicious code. The antivirus stores these signatures and scans files for matches. This method is reliable for known threats but needs frequent updates because new viruses appear regularly.

Heuristic analysis: Heuristic detection looks for suspicious characteristics or actions rather than exact signatures. It examines the structure of code or how a program behaves—such as trying to modify many files or access system areas—to decide whether it might be malicious. Heuristics can catch new or modified viruses but may sometimes flag harmless files as suspicious.

Real-time protection and scheduled scans: Many antivirus programs run real-time protection that checks files when they are opened, copied or downloaded. Scheduled full system scans allow deeper inspection during quiet times. Both features are important: real-time for immediate protection, and scheduled scans for thorough checks.

Quarantine, repair and removal: When a threat is found, the antivirus may repair the infected file by removing the malicious part, delete the file, or move it to quarantine. Quarantine is a safe area where the file cannot execute; this lets users review the file before permanent removal.

Updates and cloud services: Antivirus programs update their signature databases frequently. Modern tools may also use cloud-based analytics where suspicious files are checked against a central service for faster and broader detection. This helps detect new threats quickly and reduce local resource use.

User responsibility: Despite good antivirus protection, safe user habits are essential. Do not ignore alerts, keep the software updated, and avoid risky downloads. Antivirus is a strong defence but works best with careful behaviour.

Introduction: Preventive measures reduce the chance of infection and limit damage if an infection occurs. These include good habits, configuration choices and communication. Students and families benefit when prevention becomes routine.

Safe user habits: Avoid opening attachments or running programs from unknown senders. Be careful with downloads and do not accept software offered by pop-ups. Teach family members not to share passwords and to be cautious with unfamiliar messages or requests.

Use of accounts and permissions: Use separate user accounts for daily work and reserve administrator accounts for installing approved software only. Limiting administrator rights prevents many viruses from installing themselves without permission and reduces accidental changes that weaken security.

Keep antivirus and firewall active: Install reputable antivirus and enable the operating system firewall. Ensure both are kept up to date and that real-time scanning is turned on. Many antivirus packages also include web protection to block malicious sites.

Handle removable drives carefully: Scan USB drives and memory cards before opening files and avoid using drives of unknown origin. Use the operating system’s eject feature before removing drives to avoid file corruption and accidental spread of infections.

Network and sharing settings: Turn off automatic file sharing on public networks and only enable sharing on trusted home or school networks. Configure routers with a strong password and keep their firmware updated to avoid network-level vulnerabilities.

Education and reporting: Teach students how to spot suspicious emails and files, and encourage prompt reporting to teachers or IT staff. Sharing what you learn helps the whole class avoid common mistakes and strengthens the school’s overall security.

Summary: Prevention combines careful behaviour, correct settings, and updated protection tools. Together these steps make it much harder for viruses to enter and spread.

Introduction: Browsing and downloading are everyday activities for students, but they can introduce risks if done carelessly. Safe downloading and browsing means choosing trustworthy sources, checking files, using browser protections and thinking before clicking links.

Choose trusted sources: Only download software, media or documents from official websites or known educational portals. Avoid file-sharing or torrent sites that offer pirated content; such sites often hide malicious installers or bundled programs that install malware without clear consent.

Check files and extensions: Pay attention to file types. Executable files (such as .exe) and scripts can run code immediately, so avoid running these unless you trust the source. Prefer files in safe formats like .pdf or .docx from trusted providers and scan files with antivirus before opening them.

Use browser security features: Modern browsers include warnings for insecure websites, pop-up blockers, and sandboxing to limit harm. Keep these features enabled and update the browser regularly. Do not bypass security warnings about invalid certificates or unsafe pages.

Avoid deceptive advertisements and fake downloads: Some web pages show buttons that look like download links but actually install unwanted software. Learn to recognise genuine download buttons and read the page carefully. If a download starts without clear consent, cancel it and close the page.

Verify before installation: When possible, check digital signatures or official checksums offered by the publisher to ensure the file is genuine. Read reviews or ask a teacher before installing unfamiliar apps, especially from third-party stores.

Think before clicking: Links in emails, messages or social media may lead to malicious sites. Hover over a link to see the real address, and if unsure, type the known site address into the browser yourself. These simple habits prevent many infections.

Introduction: Email and messaging are central to school work, but they are common ways for viruses to spread. Learning to recognise suspicious messages and handle attachments safely protects students and the wider school community.

Recognise phishing and scams: Phishing emails pretend to be from trusted sources to trick you into giving passwords or opening attachments. They often use urgent language, ask for personal information, or contain unfamiliar sender addresses. Look for errors, mismatched sender names, and incorrect URLs when you hover over links.

Handle attachments with care: Never open attachments from unknown senders. If an attachment is unexpected from someone you know, confirm by asking them through a different channel, like a phone call or a face-to-face question. Avoid opening files with double extensions like homework.pdf.exe which hide executable code behind a trusted-looking name.

Links and passwords: Avoid clicking links in messages that ask you to sign in or enter personal details. Instead, type the official website address into the browser. Never send passwords or sensitive information by email, and do not store them in easily accessible places.

Use spam filters and reporting: Make use of email spam filters which block many phishing attempts automatically. If you receive a suspicious message, report it to your teacher or the email provider so it can be blocked for others too. Deleting such messages prevents accidental clicks.

Instant messaging safety: On chat apps, be cautious when receiving files or links from people you barely know. Set privacy options so only known contacts can send you messages or group invites. Avoid joining unknown groups that may share harmful content.

Summary: Careful handling of attachments and links, combined with reporting and the use of filters, reduces the risk of infection from email and messages and keeps school communications safer.

What updates are: Software updates and patches are changes released by software makers to fix bugs, improve features and close security holes. Developers publish these updates after discovering problems that could be misused by attackers. Installing updates helps close the doors that viruses and other malware might use.

Why updates matter for security: Many malware attacks exploit known vulnerabilities in operating systems, browsers or applications. When a vulnerability is found, a patch removes it or limits how it can be used. If users do not install patches, their computers remain open to attacks that have already been discovered and described publicly.

Types of updates: Updates range from small security patches to major version upgrades. Security patches correct specific vulnerabilities, while feature updates may include security improvements too. Some updates also improve compatibility with antivirus and other protective software.

Automatic vs manual updates: Automatic updates are convenient and ensure critical patches are installed quickly. For school-managed computers, updates may be scheduled by technicians. For personal devices, enabling automatic updates is a good practice, but review update prompts to avoid installing untrusted software.

Updating third-party apps: Remember to update web browsers, plugins, document editors and media players as well as the operating system. Many attacks target these commonly used programs because they are often outdated on classroom machines.

Back up before major updates: While updates are intended to improve safety, it is wise to keep backups of important files before a major system change, in case an update fails or causes compatibility problems.

Summary: Regularly installing updates is a simple and effective way to reduce the risk of infection. Encourage classmates and family to enable updates so fewer devices remain vulnerable.

Purpose of backups: Backups are copies of important files kept separately so they can be restored if the originals are lost, damaged or encrypted by malware. Backups are a safety net that reduce the consequences of infections, hardware failure or accidental deletion.

Types of backups: Simple local backups copy files to an external drive like a USB disk or hard disk. Cloud backups store copies on remote servers operated by trusted providers. Both methods have their advantages: local drives are fast to use, while cloud backups protect data even if the physical device is lost or destroyed.

Backup frequency and versions: Decide how often to back up based on how often files change. For students, daily or weekly backups are common. Keeping multiple versions of a file helps if you need an earlier copy. Some backup tools keep a history so you can restore files from different days.

Offline and offsite copies: Ransomware can encrypt files on connected drives and cloud services that synchronise automatically. To protect against this, keep at least one backup offline or disconnected from the main computer so it cannot be reached by malware during an infection.

Recovering files: If files are lost or damaged, the recovery process restores the latest good copy from backup. Before restoring, ensure the system is clean by running antivirus scans so the backup does not become reinfected. After restoring, check files to confirm they open correctly.

Testing backups: Regularly test backups by opening saved files. A backup that cannot be restored is useless. Make sure you know how to access backups and restore them if needed.

Summary: Good backup habits—regular schedules, multiple locations, offline copies and testing—ensure that students can recover homework and projects quickly after a problem and minimise disruption to learning.

Initial reaction: If you suspect a computer is infected, stay calm and act carefully. The first and most important step is to prevent the infection from spreading to other devices or the network. Disconnect the computer from the internet and any shared drives. This reduces the chance of the virus copying itself to other systems.

Run antivirus scans: Update the antivirus program if possible, then run a full system scan. Follow the software’s recommendations: it may clean the file, move it to quarantine or delete it. Quarantine isolates suspicious files so they cannot run; keep a record of what was found in case you need help later.

Use safe mode and rescue tools: Some malware blocks antivirus or restarts the machine. Starting the computer in safe mode runs only essential services and can allow removal tools to work. Many antivirus companies offer rescue disks or bootable media that start outside the normal operating system to remove stubborn infections.

Restore from backup if necessary: If important files are corrupted or encrypted, restore them from a clean backup made before the infection. Only restore files after the system is cleaned, otherwise the virus may reinfect the restored files. If backups are not available, consult a teacher or technician for specialised recovery steps.

Change passwords and check accounts: After cleaning, change passwords for online accounts accessed from the infected computer. Monitor school accounts, email and cloud storage for unauthorized activity and inform relevant people if you suspect misuse.

Document and learn: Record the steps taken and what worked so that others can learn. Share the lesson with the class and follow up by improving prevention measures, like enabling updates and better backup routines.

When to seek help: If the infection is complex, cannot be removed, or involves sensitive information, ask a teacher, school IT staff or a trusted technician. Avoid risky removal methods found on untrusted websites.

Ethical principles: Using computer knowledge responsibly means avoiding actions that harm other people or their property. Creating, distributing or using viruses deliberately damages files, invades privacy and disrupts learning. Ethical behaviour requires respect for others’ work, privacy and digital property.

Legal consequences: Many countries have laws that make writing, distributing or using malware illegal. Penalties vary but can include fines, school discipline, or even criminal charges in serious cases. Students should understand that curiosity is natural, but experimenting with harmful code without permission can lead to serious trouble.

Responsible disclosure: If a student discovers a vulnerability in school software, a website or a system, the responsible course is to report it to a teacher or administrator rather than exploiting it. This practice, called responsible disclosure, helps fix problems without causing harm.

Respect for privacy: Accessing other people’s files or accounts without permission is unethical and often illegal. Even if you discover information accidentally, do not share it; instead tell a teacher so it is handled properly. Respecting others’ privacy builds trust and keeps the school environment safe.

Learning skills for good: If you are interested in security, study it through approved channels. Many courses and clubs teach cybersecurity in safe environments where students can learn defensive skills, such as how to secure systems and remove malware, without breaking laws or causing damage.

Community responsibility: Encourage classmates and family to follow safety practices. If someone is spreading a virus unknowingly, help them clean their system and teach them better habits. Helping others prevents harm and improves the whole school’s security.

Summary: Ethics and law guide safe use of computers. Use knowledge to protect and improve systems, not to break them. Reporting problems and learning in proper ways keeps everyone safe and avoids serious consequences.

Purpose of activities: Practical activities help students understand the principles of viruses and protection without risking real infections. Classroom projects can demonstrate the spread of an idea in a safe way, teach good habits, and build skills in reporting and recovery.

Simulations and role-plays: One safe activity is a simulation where harmless files are used to mimic infection. For example, give students cards marked with a symbol representing a virus; when a card is passed during a game, the teacher tracks how quickly it spreads and then discusses prevention steps. Role-plays can show how phishing works and how to respond.

Poster and awareness campaigns: Groups of students can create posters or presentations on topics such as safe downloading, email caution and backup routines. Displaying these in the computer lab and corridors helps spread good practices across the school community.

Guided experiments: Teachers can use non-malicious scripts that display a message when opened to demonstrate how a macro virus might act. These scripts should never harm data and must be run only in a controlled environment with teacher supervision.

Research assignments: Assign small research tasks on famous malware incidents focused on consequences and recovery rather than technical attack methods. Students should summarise what went wrong, how it was fixed, and what lessons were learned.

Group projects and presentations: Students can work in teams to prepare a step-by-step guide for cleaning an infected machine, create a checklist for safe computing, or demonstrate a backup plan. Presenting these projects reinforces learning and builds communication skills.

Reflection and assessment: After activities, discuss what worked, what was surprising, and what habits students will change. Include short quizzes or practical checks where students demonstrate scanning a USB drive or identifying a suspicious email.

Revision of main points: This review brings together the unit’s important ideas: what viruses are, common types, how they spread, signs of infection, how antivirus works, and preventive actions such as safe downloads, email caution, updates and backups. A short checklist helps students remember daily habits that protect their work and privacy.

Quick safety checklist items: 1) Keep antivirus installed, updated and running real-time scans. 2) Do not open email attachments or click links from unknown senders. 3) Scan removable drives before opening their contents and avoid using untrusted USBs. 4) Enable automatic updates for the operating system and applications and install patches promptly. 5) Back up important files regularly and keep at least one offline copy. 6) Use strong passwords, avoid sharing them, and use a standard user account for daily tasks instead of an administrator account.

When to ask for help: If you see suspicious behaviour—strange pop-ups, missing files, or disabled security—disconnect from the network and tell a teacher or technician. Do not try random fixes found online without asking, and do not forward suspicious files to classmates.

Daily habits to adopt: Before starting work in the lab, check that antivirus is active, devices are updated, and USB drives are scanned. Think before downloading files, and report anything unusual. These simple checks take little time but prevent many problems.

Long-term approach: Technology and threats change, but safe habits remain effective. Keep learning about new risks, share knowledge with family and friends, and treat digital safety as an important life skill. Use the checklist as a reminder: prevention, detection, and recovery together protect your learning and privacy.