= Computer virus
A \b[computer virus] is self-replicating code that propagates by becoming part of host <computer programs> or suitable <files>. Its replication depends on the host's execution context. This distinguishes it from a self-contained <computer worm>, although both are conventionally grouped as <malware>.<Malware and virus entries in the NIST Computer Security Resource Center glossary>[Virus definitions and NIST SP800-83r1 section2.1, replication through host programs or data files]{ref}
Replication and any additional harmful effect are separate features. A <computer virus> can make unauthorized changes simply by incorporating itself into another host; a dramatic data-destruction effect is not necessary to recognize that replication mechanism.
For an original counting example, imagine ten archived copies of the same infected host file on an isolated storage medium. That is ten stored artifacts, not evidence of ten running processes or ten infected computers. Conversely, one executing host can affect more than one stored artifact. Counts of detected files, affected machines and active executions measure different things.
The biological analogy is useful only in a limited sense: a <computer virus> depends on a host context for reproduction, but its mechanism is computation and file modification. <Digital evidence> about copies and execution should support the particular incident claim being made, rather than treating every occurrence of a byte pattern as a separate observed infection event.
Back to article page
