It becomes active when that host is opened, loaded, or executed. This host dependence distinguishes a virus from a self-contained worm.
After activation, a virus may find and modify other suitable hosts. Infected objects can move through shared storage, attachments, downloads, synchronization, or removable media, but another action normally transfers or runs the host. Replication is separate from any payload, such as theft, corruption, or further malware installation.
Key points
Host relationshipThe infected object carries or activates the viral code. Hosts and infection methods vary by platform, so “file virus” does not describe every virus.
ScopingIdentify the original execution, potentially infected hosts, distribution paths, privileges, and payload. Checking only the first detected file can miss modified objects elsewhere.
RecoveryQuarantine or replace affected objects using tested procedures, close the entry path, and validate systems and shared repositories. Preserve representative evidence when required.
Important limitationA signature can identify a known pattern without finding every infected object or action. A suspicious file is not a virus unless host-dependent replication is part of its behavior.