The objective of this study is to develop and test a model of online protection behaviour, particularly regarding the use of virus protection. Hypotheses are proposed concerning the predictors of the intention to engage in virus protection behaviour. Using a survey of 273 college students who use the Internet, a test of the hypotheses is conducted using multiple regression analysis. The result suggests that perceived self-efficacy in using virus protection measures, perceived response efficacy of virus protective measures, positive outcome expectations of virus protection measures, perceived vulnerability to virus threats and prior virus infection experiences were the most important predictors of the intention to adopt virus protection behaviour. The conclusion is that those who are in charge of information security management should not only concentrate their efforts into increasing individuals' awareness of the likelihood of virus attacks, but also conduct interventions aimed at increasing self-efficacy and response efficacy beliefs.