What is a good way to explain computer viruses? As part of my class, pupils have to learn what a virus is.

I am looking for a better way to explain viruses or a better metaphor than the biological virus. The problem with a biological virus as a metaphor is that if we follow it to its logical conclusion, then if there is even the slightest problem in the metaphor, it will interfere with students reasoning down the line, which could lead to false conclusions and confusion.

When I was at university in (1991), we were told some simple rules for the computer lab:


No drinking or eating in the lab.
Don't hit the computers, poke anything into them, or try to take them apart.
Don't switch them off (someone else may be using it).
Don't worry, if you tell it to do something and it breaks then it is our fault not yours. Our job is to keep them from breaking, we do this by using good quality software. These is security to stop you from breaking it for any one else. If you break it for you, then come and see us, and we will fix it. If you break the security, and we encourage you to try, then do not do anything malicious as this is immoral and criminal, just come and see us and tell us, so we can fix the software bug, and give you your prize.


We are now telling students that they can easily break the computer by clicking the wrong button. This includes infecting a computer with a virus.

I am not happy with the normal descriptions of a virus, as these put all of the blame onto the virus writers, and all of the responsibility onto the user/children.

Some descriptions that I have seen.


“each requiring a different cure”
Why? There are thousands of viruses, but only a small number of vulnerabilities. Viruses take advantage of vulnerabilities. Would it not be easier to fix the vulnerabilities.
“prevention better than cure” (true). But goes on about how a virus scanner can check programs before you run them. This is putting the blame on to the viruses, and the responsibility on to the children.


A better description?

Does anyone have a better way to describe a virus. How can we link it to real life; what the pupils already know.
Viruses, worms and other malware are actually just like physical infections in enough ways that I still think metaphors are the best way to educate from a basic level. Even the average home user knows that a virus scanner stops a large number of infections from ruining their PC.

The challenge comes with explaining why virus scanners are so limited - most up until now only catch what they know about. So I like to use the following:


Malware is written to control your PC or to steal your login information for online banking etc. 
Your virus scanner will protect from tens of thousands of pieces of malicious software that it knows about.
Behavioural analysis tools will pick up more malware, based on what it appears to do.


But because code is written by humans, there will always be vulnerabilities, and because there are criminals, there will always be malware that will get past these, and this is why layers of security are essential. These include:


User awareness (don't visit dodgy sites, don't click on suspect emails etc)
Secure architecture (secure by design) 
Extensive monitoring and logging
Understanding the threat environment
etc.