Quick Summary
- Boot sector viruses infect the system startup area of storage devices
- File viruses attach themselves to executable program files
- Macro viruses hide in document macros (Word, Excel files)
- Multipartite viruses use multiple infection methods simultaneously
- Polymorphic and stealth viruses use advanced hiding techniques
Understanding Computer Virus Types
Computer viruses come in many forms, just like biological diseases. Some attack when you start your computer, others hide in your Microsoft Word documents, and some change their appearance to avoid detection. Understanding virus types helps you protect your system and answer WAEC questions correctly.
Nigerian students often think all viruses work the same way. This is wrong. Each virus type has unique behaviors, infection methods, and removal requirements. WAEC and NECO examiners frequently test this topic because it shows whether you truly understand computer security.
Major Types of Computer Viruses
1. Boot Sector Virus (BSV)
Boot sector viruses are among the oldest and most dangerous virus types. They infect the Master Boot Record (MBR) – the first sector of your hard drive that loads when you start your computer.
How they work: When you turn on your computer, the BIOS reads the boot sector to start loading Windows or other operating systems. If a boot sector virus is present, it loads into memory before your operating system starts. This gives it complete control over your system.
How they spread: Boot sector viruses spread through infected floppy disks, USB flash drives, external hard drives, or CDs. If you boot your computer with an infected removable disk connected, the virus copies itself to your hard drive’s boot sector.
Examples: Michelangelo, Stoned, Form, Disk Killer
Nigerian context: In Nigerian cybercafes and school computer labs, boot sector viruses spread rapidly because many users share USB drives without scanning them first. One infected flash drive can infect dozens of computers.
Symptoms: Computer fails to boot, displays error messages during startup, system becomes very slow, or shows “Non-system disk” errors.
2. File Virus (FV) / Program Virus
File viruses attach themselves to executable files – programs that run when you click them. These files have extensions like .exe, .com, or .bat in Windows.
How they work: When you run an infected program, the virus code executes first. It copies itself to other executable files on your computer, then allows the original program to run normally so you don’t suspect anything.
How they spread: Sharing infected program files via email, USB drives, downloads from suspicious websites, or pirated software. When you run the infected program, your system gets infected.
Examples: Jerusalem virus, Cascade, Sunday
Nigerian context: Many Nigerian students download free software and games from untrusted websites. These downloads often contain file viruses hidden in setup files. Pirated software from computer markets frequently carries file viruses.
Symptoms: Programs take longer to load, file sizes increase unexpectedly, programs behave strangely, or show unusual error messages.
3. Macro Virus
Macro viruses hide inside document files like Microsoft Word (.doc, .docx), Excel (.xls, .xlsx), or PowerPoint (.ppt, .pptx) files. They use the macro programming language (Visual Basic for Applications) built into Microsoft Office.
How they work: Macros are small programs that automate tasks in documents. Legitimate macros help you work faster, but malicious macros can harm your system. When you open an infected document and enable macros, the virus runs automatically.
How they spread: Email attachments, shared documents, downloaded templates. Since people trust Word and Excel files more than .exe files, macro viruses spread easily.
Examples: Melissa virus (1999), Concept virus, Relax
Nigerian context: Nigerian students frequently share project documents, assignment templates, and exam materials via WhatsApp and email. Infected documents spread quickly through class WhatsApp groups. Teachers who receive student assignments may unknowingly infect their computers.
Symptoms: Documents create strange macros, files save automatically when you didn’t click save, unusual dialog boxes appear when opening documents, or documents behave differently than expected.
4. Multipartite Virus
Multipartite means “multiple parts.” These viruses use multiple infection methods simultaneously. They combine boot sector and file infection techniques, making them extremely difficult to remove.
How they work: A multipartite virus infects both the boot sector and program files. Even if you remove it from one location, the other infection source reinfects your system. You must remove it from all locations at once.
How they spread: Through infected floppy disks, USB drives, and executable files. Once on your system, they spread through multiple channels.
Examples: Ghostball virus, Invader virus, Flip virus
Nigerian context: Computer repair technicians in Nigerian tech markets sometimes encounter multipartite viruses that keep coming back after removal. This happens because they only cleaned one infection point, leaving the other intact.
Symptoms: Virus reappears after removal, multiple system areas show infection, both boot problems and program errors occur simultaneously.
5. Polymorphic Virus
Polymorphic viruses change their code structure each time they infect a new file. Think of them as masters of disguise – they look different every time, making detection very difficult.
How they work: The virus includes a mutation engine that rewrites its own code while keeping its function the same. Antivirus programs that look for specific virus signatures cannot find polymorphic viruses easily because the signature changes constantly.
How they spread: Like regular file viruses, but much harder to detect and remove.
Examples: Storm Worm, Virut, Marburg virus
Nigerian context: Updated antivirus software is crucial for detecting polymorphic viruses. This is why cybercafes and school labs that use outdated or pirated antivirus programs face severe infection problems.
Symptoms: Antivirus programs give inconsistent results, different scans detect different things, or virus signatures keep changing.
6. Stealth Virus
Stealth viruses use sophisticated techniques to hide their presence from antivirus software and users. They manipulate system functions to appear invisible.
How they work: When antivirus software tries to read an infected file, the stealth virus intercepts the request and shows a clean version of the file. The antivirus thinks everything is fine, but the virus remains active.
How they spread: Through various channels, but their main feature is hiding, not spreading.
Examples: Frodo, Brain virus (first stealth virus), Joshi
Nigerian context: Boot from clean antivirus CDs or USB drives to detect stealth viruses. When you boot from external media, the stealth virus cannot intercept antivirus scans because it’s not running.
Symptoms: Hard to detect – system problems occur but antivirus scans show no infections, file sizes don’t match actual disk space used.
7. Resident Virus (Memory-Resident Virus)
Resident viruses load themselves into your computer’s RAM (Random Access Memory) and remain active even when you close the original infected program.
How they work: The virus installs itself in RAM when you first run an infected file. It stays in memory, infecting every program you run afterward. Even after you delete the original infected file, the virus continues working from memory.
How they spread: Infect new files continuously as long as your computer runs.
Examples: Randex, CMJ, Meve viruses
Nigerian context: Restarting your computer clears RAM, which temporarily stops resident viruses. However, if the virus also infected other files or the boot sector, it reloads into memory when you restart.
Symptoms: All programs become infected quickly, system becomes progressively slower, programs behave strangely even after reinstalling them.
8. Partition Table Virus (Partition Record Virus)
Partition table viruses infect the partition table – the area of your hard drive that stores information about how your storage is divided.
How they work: Hard drives can be divided into sections called partitions. The partition table tells the computer where each partition starts and ends. When a virus infects this table, your computer cannot find your data or operating system.
How they spread: Through infected boot media or other viruses that specifically target partition tables.
Examples: Monkey virus, Disk Killer
Nigerian context: Partition table viruses can make your entire hard drive appear empty or damaged. Computer technicians sometimes mistake this for hardware failure and recommend buying new hard drives when proper virus removal would fix the problem.
Symptoms: Computer displays “Invalid partition table” or “Operating system not found” messages, hard drive appears empty or unformatted, cannot access any data.
9. Trojan Horse Virus
Trojan horses disguise themselves as useful programs but contain malicious code. Unlike other viruses, Trojans usually don’t replicate themselves – they rely on users installing them voluntarily.
How they work: The program appears to do something useful (like a free game, utility tool, or antivirus program) but secretly performs harmful actions like stealing passwords, opening backdoors for hackers, or deleting files.
How they spread: Users download and install them thinking they’re legitimate software. Common sources include fake antivirus programs, free software from suspicious websites, or email attachments claiming to be useful tools.
Examples: Zeus, Emotet, Beast Trojan
Nigerian context: Fake “data bundle generator” apps and “free airtime” programs shared on WhatsApp are often Trojans. Nigerian students frequently fall for these scams. Similarly, fake banking apps and “money doubling” programs target unsuspecting users.
Symptoms: Strange network activity, unknown programs appear in startup, system settings change without your permission, or firewall warnings about programs trying to connect to the internet.
Comparison of Virus Types
| Virus Type | Infection Target | Spread Method | Detection Difficulty | Removal Difficulty |
|---|---|---|---|---|
| Boot Sector | Boot sector/MBR | Bootable media | Medium | High |
| File Virus | Executable files | File sharing | Low-Medium | Medium |
| Macro Virus | Document files | Document sharing | Low | Low-Medium |
| Multipartite | Multiple locations | Multiple methods | Medium | Very High |
| Polymorphic | Various files | Like file virus | Very High | High |
| Stealth | Various locations | Various methods | Very High | High |
| Resident | System memory | Continuous infection | Medium | Medium-High |
| Partition Table | Partition table | Boot media | Medium | High |
| Trojan Horse | System files | User installation | Low-Medium | Medium |
Common WAEC Exam Mistakes
WAEC examiners report these frequent errors:
- Listing virus names instead of types: “Melissa, Zeus, Stoned” are virus names, not types. The types are “macro virus,” “Trojan horse,” and “boot sector virus.” Questions ask for types, not specific virus names.
- Confusing viruses with other malware: Students write “spyware” or “adware” as virus types. These are separate malware categories. Stick to actual virus types unless the question specifically asks for malware types.
- No explanation of how they work: Writing “Boot sector virus (BSV)” alone earns minimal marks. Explain: “Boot sector virus infects the master boot record of storage devices and loads into memory before the operating system starts.”
- Mixing up infection targets: Students say macro viruses infect executable files or file viruses infect documents. Each virus type targets specific file types or system areas.
- Using abbreviations without defining them: Write “Boot Sector Virus (BSV)” on first use, then you can use “BSV” afterward. Don’t start with abbreviations.
- Incomplete definitions: Stating what the virus infects without explaining how it works or spreads earns fewer marks.
Practice Questions
Multiple Choice Questions
- Which virus type infects Microsoft Word and Excel documents?
- a) Boot sector virus
- b) File virus
- c) Macro virus ✓
- d) Partition table virus
- A virus that changes its code structure each time it infects a new file is called:
- a) Multipartite virus
- b) Polymorphic virus ✓
- c) Stealth virus
- d) Resident virus
- Which virus type uses multiple infection methods simultaneously?
- a) Boot sector virus
- b) File virus
- c) Multipartite virus ✓
- d) Macro virus
- Trojan horse viruses primarily spread through:
- a) Automatic network propagation
- b) Users voluntarily installing them, thinking they are useful programs ✓
- c) Infecting boot sectors
- d) Copying themselves to system memory
Essay/Theory Questions
- Define and explain FIVE types of computer viruses, stating how each type infects computer systems. (15 marks)
Examiner’s tip: Choose five different virus types. For each: (1) Define what it is, (2) Explain what it infects, (3) Describe how it spreads. Use one paragraph per virus type. Award yourself 3 marks per well-explained type. - (a) What is a multipartite virus? (2 marks)
(b) Explain why multipartite viruses are difficult to remove. (4 marks)
(c) State TWO examples of multipartite viruses. (2 marks)
Examiner’s tip: Part (a) needs a clear definition. Part (b) should explain the multiple infection points and reinfection problem. Part (c) just requires two virus names – Ghostball and Invader are acceptable. - Distinguish between boot sector virus and file virus, giving TWO differences. (8 marks)
Examiner’s tip: “Distinguish” means show clear differences. Create a comparison format: “Boot sector virus infects [X] while file virus infects [Y].” Cover infection target, spread method, timing of infection, and removal difficulty. Four marks per well-explained difference. - A student downloaded a free game from an unknown website. After installation, his computer started behaving strangely, with unknown programs connecting to the internet.
(a) Identify the likely type of virus involved. (2 marks)
(b) Explain THREE characteristics of this virus type. (6 marks)
Examiner’s tip: The answer is Trojan horse. Characteristics include: disguises as useful program, doesn’t replicate itself, spreads through user installation, often creates backdoors, and steals information.
Memory Aids
Remember nine virus types with “B-F-M-M-P-S-R-P-T”:
- Boot sector – infects startup area
- File – attaches to programs (.exe files)
- Macro – hides in documents (Word/Excel)
- Multipartite – multiple infection methods
- Polymorphic – changes appearance
- Stealth – hides from detection
- Resident – stays in memory
- Partition table – damages hard drive structure
- Trojan – disguises as useful program
Most dangerous virus types (hardest to remove): “M-P-S-P”
- Multipartite (multiple infection points)
- Polymorphic (changes constantly)
- Stealth (hides from scans)
- Partition table (damages drive structure)
Related Topics
- Computer Virus – General definition and overview of viruses
- Detecting a Computer Virus – How to identify virus infections
- General Remedies of virus – Methods to remove different virus types
- Prevention of Virus Infections – Strategies to avoid virus infections
- Sources of Computer Virus – Where viruses come from