Most people use the term 'virus' to also refer to computer 'worms', which are executable programs that copy themselves from computer to computer using security holes. Most 'viruses' these days are just that, a worm.

'Worm' sounds a bit more innocent than virus, but the reference is to parasitic worms that live inside living things, not the ones living in the ground. Computer worms are close to them in that there will only be one copy of them, they are much larger, and they don't make other programs do they copying for them, but are full programs. These come in via open ports, which a firewall can help with, or malicious web pages or email messages, from other machines that are infected.

Spyware isn't viruses or worms, in that it generally won't copy itself to other computers, and it has a thin veil of legality in that you usually installed it, although you probably were tricked into it or it snuck in with some other program. Often it includes keyloggers or watch websites you browse, and it usually show ads. Basically it does whatever unethical thing will get the company that built it paid.

Sometimes spyware is installed on purpose, by other users of the computer, or on company computers. (There may be legal issues involved in removing the later.) The various governments sometimes also uses spyware, specifically keyloggers, to conduct legal 'searches' of computers, and there is a debate going on right now about whether spyare scanners should detect that. The debate was rendered mostly moot by heuristic scanners that detect all keyloggers.