When ever any program, including a virus, is 'run' on a computer, that program is picked up from it's storage location on the hard drive and is loaded into memory, where it proceeds to give instructions and get information from the hardware and other software and that is what makes your computer work. Very few things actually run from a hard drive, a hard drive is just storage that the memory can access to get the programs it needs to run the computer.
The two main types of memory that your computer uses (we won't get into processor cache) are physical RAM and virtual RAM. Physical RAM is the memory that's on a 'stick' with chips on it plugged into your motherboard, it is completely electronic and has no moving parts. This is used for loading and running programs mostly, but when it gets full we can't just not run something, that programming needs to keep running so it's 'paged out' or 'swapped' to virtual memory.
Virtual memory is kept in a file on your hard drive that's totally dedicated to acting like RAM. This file is called a 'page file' or 'swap file'. When the real RAM gets loaded as far as it can go, Windows and other systems use this file as an overflow for things that for one reason or another must remain loaded into memory.
The computer actually sees this memory as being the same as the physical RAM, the main difference is that because it's on a mechanical drive and not a solid state electronic component it's a LOT slower. There are various tricks to speed it up somewhat, but the easiest is to just add more physical RAM so that fewer critical functions get sent to the virtual RAM page file. Windows will automatically use the physical RAM for high speed operations as much as possible, then fall back to the lower speed virtual RAM on the page file on the hard drive. It will also clear things that aren't being run at that exact moment to the page file for easy access when needed and to create more room for things that are running right at that second. Even on a system with a lot of physical RAM, this process is constantly occurring but the page file (virtual memory) is accessed a lot less because it's not needed as often. That's why your computer runs faster with more physical RAM installed.
Where virus activity in the page file or virtual memory occurs is not because a virus specifically attacked the page file but because the virus was loaded into memory (it was 'run') in the first place. Often a virus will then swap itself out to virtual memory after it loads. This is why the first thing that any anti-virus program scans is memory, both physical and virtual.
The thing about virtual memory is that it's 'persistent', that page file stays on the hard drive when the computer is shut down and powered off. The physical RAM is 'volatile', when the power goes off whatever is in the chip is gone forever, it's called volatile because it's like it evaporates into nowhere. So IF a virus is still in the page file in virtual memory it can load itself when the computer starts again.
Any decent anti-virus software will catch that though, so you don't need to be concerned about it unless you don't have an anti-virus product installed, updated, and running on your computer. Virus writers LOVE people that don't think they need anti-virus software, if it wasn't for them there would be almost no virus problem.
If you're running Vista and you only have one Volume (which is a disk or a RAID array that appears as a drive letter like "C:\") then don't mess with the page file or change the virtual memory settings. You'll only slow down your system, Vista is the first Windows Operating System that actually does a very good job of handling virtual memory.
Since XP was released it's not a good idea to change the virtual memory settings to a single size that's 1.5 times the physical RAM, that's WHY you can get a "Virtual Memory Low" warning. You'll never get that warning if you don't tamper with the virtual memory settings as XP will add room to the page file automatically. XP won't expand and contract the page file, unless disk space becomes low it will just leave the page file at the largest size that has been needed so far. Setting the page file to a constant size is a very OLD trick from the days of Windows 98, NT, and 2000 that was used to get a very small gain in system performance.
Having said that, one thing that you can do is to move the page file off of the root volume, usually that's "C:\", IF you have more hard drives available to move it to. That way the Operating System can be accessing files on the System Volume (C:\) at the exact same time that it's using the page file. For instance, the computer I'm writing this on has 7 internal hard drives, so I've moved the page file to H:\ from C:\. You have to know your equipment though because moving the page file to another volume on the same hard drive will do no good at all. This computer also has a 4 GB flash drive for ReadyBoost and 8 GB of physical RAM so all it needs a page file for is to do a memory dump so I can run debugging tools in case of a system crash. With ReadyBoost and that much physical RAM the computer never uses much virtual memory.
I hope that answers your questions about virtual memory and virus activity.
Good luck and happy computing.
**Note to computer geeks** I know the difference between saving inactive virtual memory pages and segment swapping and the corresponding page vs. swap file nomenclature, that DMA and permanently resident pages also use physical memory, etc. I'm trying to make this easy to understand and informative and you don't need to be worried about the technical accuracy of the answer, get over it.