Number of sites This measures the number of locations with infected computers. This normally refers to organizations such as companies, government offices, and the like. This is the malicious activity that the virus performs. Not all viruses have payloads, but there are some that perform destructive actions. This is the condition that causes the virus to activate or drop its destructive payload.
Some viruses trigger their payloads on a certain date.
Others might trigger their payload based on the execution of certain programs or the availability of an Internet connection. A virus that has the ability to change its byte pattern when it replicates thereby avoiding detection by simple string scanning techniques. This payload might attempt to gain access to important data stored on the computer such as credit card numbers. This measures the skill level needed to remove the threat from a given computer. Removal sometimes involves deleting files and modifying registry entries.