GCSE · Computer Science · AQA · Spec 8525

Computer virus

A file called 'holiday_photos' lands in your inbox and just sits there, harmless. What is the one thing it's waiting for?

Computer Science · Malware

Rebuild the virus's spread loop

2 stages are missing. Use the rest of the loop to work out which goes where.

  1. Stage 1: An infected file is opened or run

    The virus is hiding inside a host file. A person opens the file or runs the program, usually without knowing.

  4. Stage 4: An infected copy is passed to another computer

    Passed on as a shared file, on removable storage or as an email attachment. When someone opens it there, the loop starts again.

…and stage 4 leads back to stage 1.

Predict, then check

Someone has just run an infected program. The virus is now awake.

What can the virus do now?

Computer Science · Malware

Virus, worm or Trojan?

Tick every property that is true of each type of malware. Then press check and see which cells you got wrong.

Virus
Worm
Trojan

Computer Science · Malware

Follow an unknown file

A file arrives from a source you don't know. Pick a branch at each fork to see where that route ends.

Do you open it? → Does up-to-date anti-malware recognise it?

3 routes the file can take.

On A file arrives from an unknown source. 2 branches to choose from.

Walk each route and see where the infection starts, or where it is stopped.

Watch out: Anti-malware recognises known viruses. It isn't a reason to open every file you are sent.

WHAT YOU'VE LEARNED

A quick recap of today's lesson.

What you need to know

  • A computer virus is malicious code that copies itself into other files, which then act as its host files.
  • A virus can't move by itself. It needs a host file and a person to open or run that file.
  • Have a goYour mate swears a virus 'just jumps' off his laptop and onto yours, with no help from anybody. What is he missing?

    A virus can't move by itself. It sits in a host file until a person opens or runs it.

    Without that user action the virus stays stuck in its host file, so it can't move from one computer to another.

  • Once the infected file is opened or run, the virus becomes active and copies itself into other programs or files.
  • It spreads when an infected copy is passed on: as a shared file, on removable storage or as an email attachment.
  • Have a goAn infected file is emailed from computer A to computer B. Nobody on B ever opens the attachment. Does the virus start copying itself on B?

    No. It stays inactive, because the file was never opened or run.

    Receiving a copy isn't enough. The virus only becomes active when someone opens or runs the infected file.

  • Break any link in that loop, so the file is never opened or never passed on, and the spread stops.
  • An active virus can delete or corrupt data, slow the computer down and let other malware in.
  • A worm is different: it needs no host file and can spread on its own across a network.
  • Have a goTrue or false: a worm needs a host file, and someone has to open it before it can spread.

    False. A worm needs no host file and can spread without a user action.

    That description fits a virus. The worm's difference is that it doesn't wait for a person to open anything.

  • A Trojan disguises itself as useful software to trick you into running it, and it doesn't copy itself into files.
  • Anti-malware software that is kept up to date can recognise known viruses and remove them.
  • Keeping software up to date and not opening files from untrusted sources both help stop a virus before it starts.

The big picture

A computer virus can't travel on its own. It hides in a host file, wakes up when someone opens that file, copies itself into other files, and rides along whenever an infected copy is passed on. Break any link in that loop and the spread stops. Worms and Trojans work differently, and anti-malware plus careful habits protect you.

Key points

1A virus has to be inside a host file and needs a user action to spread. It doesn't spread by itself.
2The spread is a loop: opened, active, copies itself into other files, passed on, opened on the next computer.
3Active viruses can delete or corrupt data, slow the computer down and let other malware in.
4A worm spreads without a host file or a user action. A Trojan hides behind a useful-looking disguise instead of copying itself into files.
5Anti-malware, kept up to date, recognises known viruses. Not opening untrusted files stops the loop at its first link.

Worked example

Problem

The school IT team gets three reports of malware. Report A: after a pupil opened a file from a memory stick, other files on that computer started copying the same harmful code. Report B: a program that looked like a free photo editor was installed by a pupil, then damaged files, and it never copied itself into any other file. Report C: harmful code appeared on every computer on the school network overnight, and nobody had opened or run anything. Decide whether each report is a virus, a worm or a Trojan, and give the clue that tells you.

⚠ Watch out

Using 'virus' as a name for any malware. A virus copies itself into other files and needs a host file and a user action. A worm spreads without those, and a Trojan is defined by its disguise.

🧠

Memory hook

Virus: the victim opens it. Worm: nobody has to. Trojan: somebody gets tricked.

✓

Check yourself

Draw the virus loop in four boxes. Which two points need a person, and what happens to the spread if either never happens?

Flashcards

(10)
What is a computer virus?
Malicious code that copies itself into other files (host files) and spreads when those infected files are opened and passed on.
What does a virus need before it can spread?
A host file, and a user action: someone has to open or run the infected file.
What happens the moment an infected file is opened or run?
The virus becomes active and copies itself into other programs or files.
Name three ways an infected copy can reach another computer.
As a shared file, on removable storage, or as an email attachment.
Name four things an active virus can do.
Copy itself into more files, delete or corrupt data, slow the computer down, and let other malware in.
How is a worm different from a virus?
A worm needs no host file and can spread without a user action. A virus needs both.
What makes a Trojan different from a virus?
A Trojan disguises itself as useful software to trick you into running it, and it doesn't copy itself into files.
What does anti-malware software need to be able to recognise a virus?
It must be kept up to date. It recognises known viruses and can remove them.
Give two ways to reduce the risk of a virus infection.
Don't open files from untrusted sources, and keep software and anti-malware up to date.
True or false: a virus spreads across a network all by itself.
False. That is worm behaviour. A virus needs a person to open an infected file and pass a copy on.

Tap any card to flip it, or use Study as deck to go through them one at a time. In the full lesson these run as a spaced-repetition deck — you rate each card Hard, Good or Easy and the tricky ones keep coming back until they stick.

Learning with Lightbulb is opening soon

You can use this lesson now. Join the waitlist and we'll let you know when the full Lightbulb experience is ready.

Keep me posted

More AQA GCSE Computer Science topics

See the full AQA Computer Science curriculum →

How this lesson was checked. This AQA GCSE Computer Science (specification 8525)lesson was published through Lightbulb Learning's human-designed editorial process — the educational standards, accuracy rules and publication checks it must pass were authored and approved by Philip Halpin. It passed subject-specific assessment, automated educational checks and technical publication verification before going live (publication checks completed 9 October 2026). Published pages are monitored, human spot-checking is ongoing across the lesson library, and anything found wrong is corrected or withdrawn. How our lessons are made and checked. Spotted a mistake? Email hello@lightbulblearning.co and we'll review it.