Nailed it. This is the last question in Rabbi Dovid Lichtenstein's Headlines: Halachic Debates of Current Events. (This entire discussion is summarized from pages 449-462 from that book.)
The first angle he approaches the question from is the Mazik of Eish. As recorded in the first several blatt of Bava Kamma, each Av of Nezek has its own characteristic, from which we may derive Toldos, other types of damage. A practical difference between which type of damage a particular Toldah is considered is its halachos: the times for which one is obligated for when their fire damages is very different than when their pit damages. To my knowledge, the only reason for this distinction is a Gezeiras HaKasuv.
The characteristic of Eish is that another force - namely, the wind - is responsible for the damage spreading (BK 3b). Likewise, one might argue that a computer virus is sent using a second force known as the Internet. Thus, it should be liable to the rules of Eish.
At this point in his discussion, R' Lichtenstein brings an argument that a virus might be subject to the dispute between Rashi and Tosfos regarding Tzeroros that I don't fully understand, but ultimately he concludes that even Rashi would agree it should be considered Eish.
Now, there's a dispute between R' Yochanan and Reish Lakish (BK 22a) regarding why one is chayiv to pay for Eish: Mishum Chetzyo, that Eish is considered Adam HaMazik, and thus one is liable to pay Chamishah Devarim (R' Yochanan); and Mishum Mamono, that Eish is considered one's property damaging, and thus you're only chayiv Nezek (both views). Since we pasken like R' Yochanan, we'll need to figure out which category computer viruses fall under.
The Gemara (BK 23a) brings a case of a fireproof wall that stood between the two properties at the time the fire was lit that had fallen afterwards, allowing the fire to spread. One can't say that it's Adam HaMazik, since there's no way for the person to have damaged in such a scenario. Thus, one can only be liable because his property damaged.
Thus, one might distinguish between a virus that infects the computer upon arrival versus one that requires the user to open the email. If it just needs to be on the computer's hard drive, it could be considered Mishum Chetzyo. If the user needs to open the email and let the malware inside, it could be considered Mishum Mamono.
On the other hand, perhaps one can say that since it's to be expected that people regularly check their emails, the potential for damage occurred as soon as the email was sent, and thus, even if the email hadn't been opened yet, it's still called Mishum Chetzyo. This is comparable to a wall surrounding the fire that can topple in a normal wind; it's only to be expected that the fire will escape, and thus it's called Mishum Chetzyo (Chazon Ish, BK 2:2).
On the third hand, one could distinguish between the wall that will topple, a natural occurrence, versus checking your email, a human act. The possibility of damage can't be said to be in place at the time the virus was sent if human intervention is required. After all, if you throw a fragile object at a cushion, you're absolved of damages that occur if someone removes the cushion, since when you threw the object, no damage was going to occur (BK 26b).
R' Lichtenstein now focuses on practical differences between Mishum Chetzyo and Mishum Mamono in our case of a computer virus:
Sheves: Say that the virus is of a type that the computer exploded as soon as he opened the email, or the virus otherwise prevented him from doing his job and he therefore lost his income for the time being. If you hold that a virus is considered Eish Mishum Chetzyo, you would be liable to reimburse him for that, whereas if the virus is considered Mishum Mamono, you would be patur.
Tamun: Another little piece I don't quite understand. There's a heter by Eish that you're not liable for things that are hidden, but you're still liable if their location can easily be made known. Since either way we're dealing with Eish, I'm not sure what the Nafka Minah is here.
Your point that it's quite possible that the sender didn't know that the virus existed: if it's considered Eish Mishum Chetzyo, we pasken Adam Muad L'Olam and he would be liable (see SA CM 421:2). If it's considered Eish Mishum Mamono, he would be patur.
Is it his virus, or is it one that he picked up from somewhere else and passed along to your computer? If it's not his virus, then according to Rashi (BK 22a), if it's Mishum Mamono, you would only be liable if you own the virus; if it's Mishum Chetzyo, you would be liable either way, since, as we said before, Adam Muad L'Olam.
There's one other aspect we need to consider: the victim had to participate for the damage to occur. The Gemara (BK 47b) absolves one who put poison in front of an animal, and the animal then ate it. After all, the animal didn't have to eat it. Most Rishonim explain that the culprit is not liable if the animal brought it upon itself. The Rosh (BK 6:3) explains slightly differently, saying that the owner of the animal should have taken measures to ensure that the animal didn't harm itself. It's not because of the indirect nature of the damage, the Rosh argues; it's because the owner didn't live up to a very reasonable expectation that he should have protected his animal.
Thus, if you hold it's an issue of indirect "you did it to yourself" damage, the sender should be absolved, whereas since one should not be expected to not open any email they receive, the Rosh would obligate the sender to pay. However, perhaps the rest of the Rishonim would agree you should have to pay, since it's not just an issue of indirect damage, but one of Garmi, common cases of indirect damage. Since viruses are more common than poison, perhaps they should be held liable, even where poison isn't.
As a final note, R' Lichtenstein points out that certain viruses could be considered hezek she'eino nikar and thus, in cases of viruses sent unintentionally, there's a question of whether one has to pay or not. If you sent this kind of virus intentionally, you are liable to pay d'Rabbanan.
In summary:
- If you sent a virus intentionally, then you are certainly liable to pay for Nezek, but there's a question if you have to pay for Sheves.
- If you sent a virus unintentionally, then you are liable if the virus would have infected the computer as soon as it was sent, and perhaps you would be liable even if it needed the victim's participation to infect his computer. In the event that you are liable, you might also be liable for Sheves. Depending on the situation, it might be called Hezek She'eino Nikar and you may be exempt on those grounds.
My problem with this approach:
The Gemara at the beginning of BK (5b) discusses learning out Avos from a combination of multiple Avos. Why don't we learn out the Toldah of a computer virus from the combination of Eish, as explained above, and Bor, whose attribute is that its sole purpose of existence is to damage (BK 3a)? Since a computer virus has both of these attributes, it should have both of their halachos. This could mean that you're entirely patur on havoc wreaked by malware, just like you're patur when keilim are damaged by a Bor.
