What is a computer virus?
A computer virus is a type of malware that replicates by copying its own code into other programs, files or boot sectors, and that only becomes active when a user or system opens or runs that infected ‘host’. Like a biological virus, a computer virus therefore needs a host: without an infected file it cannot spread. That sets it apart from a worm, which travels across the network on its own as a standalone program. In IT environments the classic virus has faded into the background, but in OT it lives on in old Windows systems, USB sticks and project files that travel from machine to machine.
🧠 How does a computer virus work?
The life cycle of a virus usually has four phases:
- Dormant - the virus sits in a file or boot sector and does nothing yet. Not every virus has this phase.
- Propagation - as soon as the host runs, the virus copies itself into other programs, documents, removable media or network shares.
- Triggering - a condition such as a date, a number of start-ups or a specific user action sets off the payload.
- Execution - the payload does its work. That may be harmless, such as a message on screen, but it can also delete files, steal data or open a back door for other malware.
The infected file often keeps working normally, so the user notices nothing. This allows a virus to spread unnoticed for months through shared folders, installation files and USB sticks.
🧬 What types of viruses are there?
Viruses are classified by where they hide and how they evade detection.
| Type | How it works | Example or OT relevance |
|---|---|---|
| File infector | Attaches itself to executable files (.exe, .dll) | Infected installers or tools on an engineering station |
| Boot sector virus | Lodges in the boot sector or Master Boot Record and starts before the operating system | Brain (1986), spread via floppy disks; today partly countered by Secure Boot |
| Macro virus | Written in a macro language and hidden in documents | Melissa (1999) in Word documents; Excel reports with macros on the plant floor |
| Resident virus | Stays in memory and infects every file that is opened | Hard to remove without rebooting from clean media |
| Polymorphic virus | Changes its decryption routine with every infection | Evades simple signature detection by antivirus |
| Metamorphic virus | Rewrites its entire code with every copy | Requires behavioural analysis rather than signatures |
🕰️ How did computer viruses come about?
The history of viruses shows clearly how the route of spread moves with the technology:
| Year | Event | Significance |
|---|---|---|
| 1971 | Creeper (Bob Thomas, BBN) spreads across ARPANET; Reaper is written to remove it | First self-replicating program, closer to a worm than a virus |
| 1982 | Elk Cloner (Richard Skrenta) infects Apple II floppy disks | One of the first viruses ‘in the wild’ |
| 1984 | Fred Cohen publishes Computer Viruses - Theory and Experiments; the term ‘virus’ comes from Len Adleman | Scientific basis and naming |
| 1986 | Brain, created by brothers Basit and Amjad Farooq Alvi in Lahore | First virus for the IBM PC, via the boot sector |
| 1999 | Melissa mails itself to the first 50 contacts in the address book | Breakthrough of macro viruses via email |
| 2022 | Microsoft blocks macros by default in Office files from the internet | Macro viruses lose their main route |
Since the 2000s, worms, trojans and ransomware have become far more important than classic viruses. Even so, security vendors still report virus detections on industrial computers, precisely because old systems and removable media persist there.
🔄 What is the difference between a virus, a worm and a trojan?
Virus, worm and trojan mainly describe how malware spreads. Ransomware, spyware and wipers describe what the malware does. A single attack can therefore combine both: a virus may carry ransomware as its payload.
| Type | Spread | Needs a host? | Needs user action? |
|---|---|---|---|
| Virus | Copies itself into other files or boot sectors | Yes | Yes, the infected file must be opened |
| Worm | Travels independently via networks and vulnerabilities | No | No |
| Trojan | Disguises itself as legitimate software | No | Yes, the user installs it |
| Ransomware | Encrypts data for ransom; arrives via any of the routes above | Depends on the route | Depends on the route |
| Spyware | Covertly gathers information; arrives via any of the routes above | Depends on the route | Depends on the route |
In practice, modern families are often hybrids. W32.Ramnit, for example, infects files like a virus, spreads via USB sticks and steals data.
🏭 What do viruses mean for OT environments?
In industrial environments, HMIs, SCADA servers, historians and engineering stations often run on Windows, sometimes on versions that stopped receiving security updates years ago (legacy systems). A virus initially infects these Windows hosts, not the PLC itself. The consequences can still be serious:
- Loss of view and control - a frozen HMI, or one that has to be reinstalled, means operators can no longer run the plant
- Infected project files - Stuxnet copied itself into Step 7 project files and USB sticks and so reached PLCs behind an air gap
- Spread via service laptops and USB - vendors and technicians carry infected media from one customer to the next
- Downtime from the clean-up - reinstalling an engineering station or SCADA server requires licences, project data and often the vendor
A well-known example is the Gundremmingen nuclear power plant in Germany. In April 2016 the operator RWE disclosed that W32.Ramnit and Conficker had been found in unit B on the computer system of the fuel-handling machine, a system that had been retrofitted in 2008 for data processing and visualisation. Malware was also found on 18 removable drives. Because the system was not connected to the internet, the infection did not affect operations, but it shows how viruses reach even the most isolated environments via USB and maintenance systems.
The figures confirm that the problem has not gone away. According to Kaspersky ICS CERT, malicious code was blocked in 2024 on roughly 22 to 24 percent of the industrial computers running its software in each quarter. Northern Europe scored lowest at around 10 to 12 percent. Viruses specifically were blocked on about 1.5 percent of those computers: a small but stubborn share.
🛡️ How do you protect OT systems against viruses?
Protection against viruses is part of broader OT security and follows the principle of defence in depth: no single measure is enough, but the layers together are. IEC 62443-3-3 requires protection against malicious code on systems and at the entry points of a zone in requirement SR 3.2 (malicious code protection).
- Control removable media - allow only scanned and registered USB sticks through USB Control and a scanning station outside the OT zone.
- Use antivirus where the vendor supports it - align antivirus or EDR with the system vendor’s approvals and distribute signature updates through a controlled path rather than directly from the internet.
- Apply application whitelisting - Application Whitelisting only lets approved programs run, so an infected or unknown file will not start. This works well on static systems such as HMIs.
- Segment the network - network segmentation according to the zones and conduits model limits how far an infection gets.
- Patch and harden systems - patch management closes vulnerabilities; disable autorun and unnecessary macros.
- Make and test backups - a clean, offline backup of engineering projects and server images makes recovery after an infection fast and reliable.
- Train staff and suppliers - security awareness about USB use, phishing and macros prevents the first click.
Test a scanner or scanning station with the EICAR test file: a harmless standard string of 68 bytes that every virus scanner recognises as a test virus, without bringing real malware into the OT environment. If you do find an infection, follow your incident response procedure and, where required, report a significant incident to the NCSC or the sector CSIRT.
❓ Frequently asked questions
Is a computer virus the same as malware?
No, a computer virus is a specific kind of malware. Malware is the umbrella term for all malicious software, including worms, trojans, ransomware and spyware. A computer virus is distinguished by spreading through copying its code into other files or boot sectors.
Can a computer virus infect a PLC?
An ordinary computer virus runs on Windows and does not infect the firmware or program of a PLC. Targeted malware such as Stuxnet did show that an attacker can alter PLC code through infected project files on an engineering station. The PLC is therefore usually affected indirectly, via the Windows systems used to program it.
How does a computer virus get into an isolated OT network?
A computer virus usually reaches an isolated OT network via USB sticks, vendors’ service laptops, infected installation files or shared network folders. An air gap therefore does not stop a virus as long as media and laptops move in and out. A scanning station and strict USB rules are essential for that reason.
Is antivirus on HMIs and SCADA servers a good idea?
Antivirus on HMIs and SCADA servers is a good idea, provided the system vendor has approved the combination of software and version. An untested scanner can block files or disrupt performance. On systems that hardly ever change, application whitelisting is often a better or complementary measure.
Do macro viruses still exist?
Macro viruses still exist, but they have become much rarer since Microsoft started blocking macros in Office files from the internet by default in 2022. In plants, however, Excel files with macros are still widely used for reporting and recipe management. Restrict macros to signed and approved files for that reason.
What should you do if you find a virus on an OT system?
Isolate the infected system from the network without making the plant unsafe, and alert the operator and your OT security team. Investigate which other systems and USB sticks may be infected, and restore from a clean backup or a reinstallation. Record the incident and report it where the law requires.
📌 In summary
A computer virus is malware that spreads by copying itself into other files and only becomes active when those files are opened. In IT the classic virus has largely been displaced by worms and ransomware, but in OT it remains a real risk because of old Windows systems, USB sticks and service laptops. Layered measures reduce that risk to a manageable level.
A virus needs a host and a click: control removable media, software and network connections into the OT environment and you take away its route - especially in environments where continuity is crucial, such as industrial automation.