Types of Computer Viruses Explained (With Examples)

A computer virus is a type of malware that attaches its code to a legitimate file or program and spreads by copying itself into other files when the infected host is run. The word gets used loosely to mean any malicious software, but a virus is one specific category with a defining trait: it needs a host and, usually, a person to set it loose.

Virus, malware, worm, trojan

Before the types, the vocabulary, because confusing these terms leads straight to the wrong defense.

• Malware is the umbrella term for all malicious software — viruses, worms, trojans, ransomware, spyware, rootkits and the rest. A virus is a subset of malware, not a synonym for it.
• A virus attaches to a host file or program and needs that host to be run to replicate, often relying on a user to open or execute it.
• A worm is self-contained and spreads on its own across networks by abusing vulnerabilities or weak credentials — no host file, no user action — which is why worms can propagate explosively.
• A trojan is malware disguised as something legitimate. It tricks a user into running it but does not self-replicate at all.

So the shorthand is: a virus needs a host and usually a user, a worm spreads itself, and a trojan relies on deception. Antivirus software, despite the name, detects all of these, not only classic viruses.

The main types of computer virus

Viruses are usually classified by what they infect and how they hide.

• File infector. The classic virus. It attaches to executable programs and runs its code whenever the infected program is launched, then looks for more programs to infect. Historically these attached to executable files and system binaries.
• Macro virus. Lives inside the macros embedded in documents and spreadsheets rather than in a standalone program. It triggers when the document is opened and macros run. Because office documents are shared so freely, macro viruses spread easily — which is exactly why modern applications disable macros from untrusted sources by default.
• Boot-sector virus. Infects the startup code a machine runs before the operating system loads. Because it executes so early, it can be stealthy and hard to remove. These spread historically through infected removable media.
• Polymorphic virus. Changes its own code on each infection — commonly by re-encrypting itself with a different key — so that no two copies share the same byte pattern, defeating simple signature detection.
• Metamorphic virus. Goes further and rewrites its entire body on each generation rather than just an encrypted wrapper, making signature detection even harder.
• Multipartite virus. Infects by more than one route at once — for example both executable files and the boot sector — so cleaning one vector leaves the other to reinfect.
• Resident virus. Loads itself into memory and infects files as they are accessed, so it keeps working after the original host closes. A non-resident virus instead runs, infects a few targets, and exits.

These categories overlap freely — a single virus can be polymorphic, resident and multipartite at once. The labels matter less than the two questions they answer: how does it spread, and how does it hide?

Why the old defenses stopped being enough

Traditional antivirus worked by matching files against a database of known signatures — fixed patterns of known-bad code. Polymorphic and metamorphic viruses exist specifically to beat that model: if the code looks different every time, there is no stable signature to match. That is the central reason defense has shifted from asking "does this file look like known malware?" to asking "is this code behaving like malware?" A virus still has to act — write to other executables, modify boot code, inject into memory, contact a server — and behavior is much harder to disguise than appearance.

Defending against viruses today

Effective protection is layered and leans on behavior, not just signatures:

• Patch promptly. Many viruses and especially worms spread by exploiting known, unpatched flaws. Closing those removes the path.
• Run modern endpoint detection and response (EDR). Behavior-based detection catches polymorphic and never-before-seen malware that signature-only tools miss.
• Restrict macros and untrusted executables. Block macros from documents that arrive from outside the organization, and prevent unapproved programs from running.
• Enforce least privilege. Malware that does execute should not be able to spread system-wide or persist if the account that ran it has limited rights.
• Keep tested, offline backups. So that even a successful infection — including destructive ransomware — can be contained and reversed without paying or losing data.
• Train people. The host-plus-user pattern means a wary user who does not open the unexpected attachment stops many infections before they start.

Viruses are best thought of as one branch of the wider malware problem, and the right response is the same layered, behavior-aware posture described in our defense in depth and attack vector explainers. Understanding how each type spreads tells you which layer catches it — and no single layer catches them all.

Frequently asked questions

What are the different types of computer viruses? File infectors, macro viruses, boot-sector viruses, polymorphic and metamorphic viruses, multipartite viruses, and resident versus non-resident viruses — classified by what they infect and how they hide.

How does a virus differ from a worm and a trojan? A virus needs a host file and usually a user; a worm spreads itself across networks with no host; a trojan is disguised malware that does not self-replicate.

Is a virus the same as malware? No. Malware is all malicious software; a virus is one category of it, defined by replicating through infected files or programs.

What is a polymorphic virus? One that changes its own code on each infection to avoid signature detection; a metamorphic virus rewrites its whole body, not just an encrypted wrapper.

How do you protect against viruses today? Patch, run behavior-based EDR, restrict macros and untrusted executables, enforce least privilege, keep tested offline backups, and train users.