system
Given the following post, respond as if you're commenting on Reddit:
human
ELI5: How and why do people create viruses?
gpt
In the past, most viruses were bored, intelligent teenagers showing off how much smarter they were than whoever designed the system they were hacking. Those people still exist ("script kiddies"), but modern hacking more often done for profit, by either individuals or organized crime. Some viruses are also created by spy agencies for spying.

The most common and general type of profit-driven malware is something called a "botnet." This is when a virus gets the rights to run software on your computer. Then, the hacker makes money by renting out your computer to a third party. A hacker will usually do this to a few million computers in order to get enough computing power to sell, and so that no one infected computer is working too much extra for their real owner to notice. The people who rent botnets are usually doing criminal with them (like breaking passwords), and that's why they're not renting a normal server farm or clould platform like Google, Amazon, or Microsoft.

Another common general type of profit-driven viruses is scamware: a program that tries to get you to pay someone with a credit card. These generally throw up advertisements, and will sometimes hijack your internet connection in order to replace real links with their own links. Sometimes they'll convince you that they're an antivirus. I've also seen some that will start encrypting files on your hard drive, and hold them ransom for the decrypt key. These viruses have the redeeming quality that they let you know they're on your system.

Another common profit-driven virus is one that tries to steal financially-sensitive data. If you've ever heard of a "keylogger," that's one type: they view your websites and record your keystrokes, and try to sniff your email and bank passwords. Depending on the virus, they also try and nab social security numbers or credit card numbers, that sort of thing. If the virus finds it, it sends it back to the hacker, who sells it.

A different type of virus is used when the hacker's target is a specific person or organization. These viruses are generally intended to find specific pieces of information on a computer or network, and "phone home" with this information. Getting a virus like this onto the right computer is a challenge, and often requires physical work, like sneaking into a building to install a hardware component, or targeting someone with fake emails. 

How viruses actually work: It's a computer program, doing computer things. Downloading a program from the internet and running it is a perfectly normal thing for a computer to do. That's what Steam does, when you get a game. That's what Flash does. Hell, that's what a web browser does, every time you view a web page with JavaScript on it. The actual work that a virus gets done is just a normal program, like any other program on your computer. The thing that makes a virus different is that the user doesn't want the virus, and the author of the virus is trying to trick the user. 

Modern computer systems have a crapton of security systems, that are supposed to make it so that if a program wants to do something (install software, access the internet, etc), it's because the user actually wanted that to happen. All those annoying pop-ups on your computer that want you to click OK before doing something, that's your computer's security system making sure the program is legit and not a virus.

A virus needs to get past those security features. There are two general ways of doing this: Social engineering, and exploits. Social engineering means "tricking the user." Lie to the user, and have the user tell the OS that the program is ok. If your grandma has ever downloaded a cat screensaver from a Belorussian website and ended up infected, that's how it happened: the virus claimed to be a good program, and the user told the computer to let it do its thing. 

Exploits means finding a bug in the computer's security features, and bypassing them with sneakiness. Computer systems are immensely complicated structures, built by thousands of individuals over the course of decades, and trying to fulfill hundreds of different (and sometimes contradictory) goals. To put it bluntly, they're not perfect. All of the pieces don't always fit together exactly perfect, and sometimes someone is trying to make changes to a piece of code written twenty years ago that they don't fully understand. And to make it worse, security wasn't even a thing until like ten or fifteen years ago, so whatever security features are there were bolted on to the side of a half-understood juggernaut of code from the crustaceous era.

Point is, it's possible to find bugs in the OS's security code. And if you find the write bug, you can write a program that does something it's not allowed to do. Like installing software or connecting to the internet without warning the user.

Most viruses in the wild actually combine social engineering and exploits. If you've ever gotten an email/text/IM/facebook from a fake name with a stock porn photo that says "ey bb u wan sum fuk" with a link to a web page, that's social engineering. The web page they link to will use an exploit to try and install a virus.