There are really two types of virus. Both prey upon stupidity, though one will be the trusting nature of a user and the other will take advantage of some known flaw. The former is generally "easier" since user stupidity is one thing that can be relied on: a virus that runs when somebody inadvertently opens an untrusted application within an email is not so much easier to code as easier to deploy. The latter method relies on the stupidity of system administrators (and on your home machine that's you) in not applying system patches when problems are announced. This is precisely what the recent spate of viruses have attacked: unpatched systems that exhibited flaws for which patches already existed. As for the knowledge required in the former case, a batch file that deletes (or better yet renames) all files would do the trick. As for the latter, you'd need knowledge of the software to be attacked, a test system, knowledge of buffer overrun techniques and network security.