Overall, I found four distinct folk models of `viruses.' These models differed in a number of ways. One of the major differences is how well-specified and detailed the model was, and therefore how useful the model was for making security related decisions. One model was very under-specified, labeling viruses as simply `bad.' Respondents with this model had trouble using it to make any kind of security-related decisions because the model didn't contain enough information to provide guidance. Two other models (the Mischief and Crime models) were fairly well-described, including how viruses are created and why, and what the major effects of viruses are. Respondents with these models could use them to extrapolate many different situations and use them to make many security-related decisions on their computer.