The Word That Means Everything and Nothing
‘Computer virus’ is used colloquially to mean any malicious software, which is both understandable and inaccurate. In technical usage, a virus is a specific type of malicious code that replicates itself by attaching to legitimate files — the distinguishing characteristic is self-replication through file infection. Most malicious software that affects computers today is not technically a virus in this sense: ransomware, spyware, trojans, adware, rootkits, and worms are different malware categories with different behaviour, different spread mechanisms, and different effects.
Understanding these distinctions matters because different threats require different defences, and the advice calibrated for one threat type may be irrelevant for another. The advice to ‘not open email attachments from unknown senders’ was the primary defence against the email-attachment malware that dominated the early 2000s; it’s far less relevant to the credential-theft phishing that dominates today, which requires no attachment download to be effective.
How Malware Actually Spreads in 2026
Drive-by downloads are the primary technical malware delivery mechanism for consumers: visiting a website that contains malicious JavaScript or exploits a browser vulnerability causes malware to download and execute without any deliberate action by the user beyond visiting the page. This is why keeping browsers and browser plugins updated is the most important technical defence against web-delivered malware.
Software bundling is the most common mechanism for potentially unwanted programs (PUPs): installers for free software that bundle additional software (toolbars, browser extension hijackers, system optimisers that are actually adware) and install it alongside the desired program unless the user deselects it during installation. Reading installer dialogs carefully and choosing custom installation when available — rather than clicking Next through every screen — prevents most PUP installation.
Ransomware: The Most Financially Damaging Current Malware
Ransomware — malware that encrypts the victim’s files and demands payment for the decryption key — has dominated malware news for the past decade because its financial impact is large, immediate, and concrete. Enterprise ransomware attacks have disrupted hospitals, infrastructure operators, and major businesses with ransom demands in the millions. Consumer ransomware targets individuals’ personal files with demands of hundreds to thousands of dollars.
The defence against ransomware is primarily backup rather than detection: ransomware that’s reached the encryption stage has already succeeded in its attack; the question is whether the victim has a copy of their files that ransomware can’t reach. The offline backup (not connected to the computer being backed up, not accessible via the network) that ransomware can’t encrypt is the recovery option that makes the ransom demand irrelevant. This connects directly to the 3-2-1 backup strategy covered in the Software section of Vol. 4.
Social Engineering: Where the Human Is the Vulnerability
The majority of successful malware infections in 2026 involve user action — downloading a file, entering credentials on a phishing page, approving a request that looks legitimate — rather than purely technical exploitation. The technical defences (patched software, updated antivirus) make purely technical attacks harder; the social engineering attacks that require user action continue to work because they exploit cognitive patterns rather than software vulnerabilities.
The most effective social engineering malware delivery: fake software installers (a search for popular software produces sponsored results or SEO-optimised pages serving malicious installers alongside or instead of the legitimate download), cracked software from piracy sources (modified installers with malware bundled alongside the cracked application), and fake update notifications (browser popups claiming Adobe Flash, Java, or the browser itself needs updating and directing to a malicious download).
The Practical Protection That Actually Works
The protection stack that addresses 2026’s realistic threat landscape: keep the operating system and browsers automatically updated (patches for known exploits are the primary technical defence), use a reputable browser with enhanced security mode enabled and keep extensions minimal (each extension is a potential vulnerability), download software only from official sources (manufacturer websites, official app stores) rather than third-party download sites, maintain offline backups for ransomware recovery, and use strong unique passwords with MFA for accounts that would be valuable targets.
The protection that’s been historically over-marketed and is now being re-evaluated: traditional signature-based antivirus that detects known malware by matching files against a database of known malware signatures. This approach misses novel malware (not yet in the signature database), polymorphic malware (that changes its signature to evade detection), and fileless malware (that operates entirely in memory without writing files that can be scanned). Modern security products have largely moved to behaviour-based detection; Windows Defender’s behaviour monitoring is as effective as most third-party alternatives for the threats it’s designed to detect.