viruses can and are written in c++, c, asm, vb...just about any programming language. html is a mark up language and can be used to make your computer download a virus (as in the hta problem) which itself is written in a programming language. Ive never seen or heard of a virus being written in html. Java script, vbs, wsh etc. can be used which is then inbeded in the html but never just html

Viruses and Trojans are often bound to innocent programs and if done correctly can go pretty much undetected by av software. Av companies are always on the lookout for new binders. Once they discover one they add the signature it adds to anything it binds to their def files so you can’t even bind two innocent programs together without you av going wild on you.