A computer virus is malicious software that propagates itself by modifying other programs to include a copy of itself, and runs when the infected program runs. Malware is the broader family. Every virus is malware, but ransomware, spyware and trojans are not viruses.
What does NIST say a virus is?
NIST's glossary gives two close definitions. One calls a virus a type of malicious software that propagates itself by modifying other programs to include a possibly changed copy of itself, executed when the infected program is invoked. It adds that a virus often causes damage and may be triggered by an event such as a predetermined date. Another source in the glossary calls it a hidden, self-replicating section of computer software, usually malicious logic, that propagates by infecting another program, and says a virus cannot run by itself because it requires its host program to be run.
Two ideas matter in both: self-replication and dependence on a host.
How is that different from malware?
NIST SP 800-83 Revision 1 defines malware, also called malicious code, as a program covertly inserted into another program with the intent to destroy data, run destructive or intrusive programs, or otherwise compromise the confidentiality, integrity or availability of the victim's data, applications or operating system. It calls malware the most common external threat to most hosts, causing widespread damage and disruption and requiring extensive recovery efforts within most organizations.
So the term hierarchy looks like this:
- Malware is the umbrella for any hostile code.
- A virus is malware that attaches to a host program and copies itself.
- Other kinds, such as ransomware that encrypts files or a trojan that pretends to be useful software, are different mechanisms with different defenses.
People often say virus when they mean any infection. That is fine in conversation. It becomes a problem in incident response, where knowing the mechanism tells you how it spreads and how to clean it up.
Why does the distinction help?
Because the mechanism determines the response. A file-infecting virus means you cannot trust any executable it touched, so you restore known-good copies. A trojan means you look for how it was installed and what the user was tricked into. Ransomware means you focus on isolation and backups first. If everyone calls it a virus, the right questions do not get asked.
A constructed example: a help desk ticket says "my PC has a virus" because documents will not open. The responder first assumes file infection and begins scanning executables. The real cause is ransomware that renamed documents. Time was spent on the wrong path while the encryption continued on a file share. Naming the mechanism early would have sent the responder straight to disconnecting the machine.
How to check or apply this
- Use precise terms in tickets and runbooks, and add a first triage question: what changed, files, programs or settings?
- Keep operating systems and applications patched, because infections need a route in.
- Run endpoint protection that is centrally managed and reports back, and do not rely on users to notice.
- Limit who can install or run unsigned software, and restrict macro and script execution where you do not need it.
- Keep tested offline backups so cleanup can be a restore.
- Read SP 800-83 for the incident handling steps, especially for outbreaks that touch many hosts.
- For code you ship, scan dependencies and builds, since malicious code can also arrive inside a package you installed yourself.
What does prevention look like for a virus specifically?
Because a virus attaches itself to programs, integrity is the lever. Application allowlisting means only approved executables run, so a modified file stands out. Code signing and hash checks let you detect a changed binary. Patching closes the route in, and least privilege limits how many programs a user account can modify in the first place. If an infected program is found, assume other programs the same account could write to may also be altered, and restore from known-good sources instead of trying to clean each file by hand.
Quick check
Can a virus run on its own?
By the NIST glossary definition, no. A virus needs its host program to be run to become active, which is part of what distinguishes it from other malware.
Is ransomware a virus?
Not by the strict definition. Ransomware is malware, but it does not need to infect other programs and copy itself into them to cause harm.
Sources
- NIST CSRC Glossary: virus, fetched 18 October 2026.
- NIST SP 800-83 Rev. 1, Guide to Malware Incident Prevention and Handling for Desktops and Laptops, fetched 18 October 2026.
Last reviewed: 18 October 2026.
