All of the respondents had heard of computer viruses and
possessed some mental model of their effects and transmission.
The respondents focused their discussion primarily on
the effects of viruses and the possible methods of transmission.
In the second round of interviews, I prompted respondents
to discuss how and why viruses are created by asking
them to react to a number of hypothetical scenarios. These
scenarios help me understand how the respondents apply
these models to make security-relevant decisions.
All of the respondents used the term `virus' as a catch-all
term for malicious software. Everyone seemed to recognize
that viruses are computer programs. Almost all of the respondents
classify many different types of malicious software
under this term: computer viruses, worms, trojans, adware,
spyware, and keyoggers were all mentioned as `viruses.' The
respondents don't make the distinctions that most experts
do; they just call any malicious computer program a `virus.'
Thanks to the term `virus,' all of the respondents used
some sort of medical terminology to describe the actions of
malware. Getting malware on your computer means you
have `caught' the virus, and your computer is `infected.'
Everyone who had a Mac seemed to believe that Macs are
`immune' to virus and hacking problems (but were worried
anyway).