Viruses: A History

Some significant events in the history of computer viruses
September 2008
by Kai Davis

"I'm the Creeper: catch me if you can."

No, it's not a slogan for a cheesy horror movie. In the early 1970s, this is what some computer users saw on their screens. Some consider it the first computer virus. However, the term had not even been coined yet!

"Computer virus" did not enter the English language until 1983. University of Southern California doctoral student Fred Cohen used it to describe a program that can "affect other computer programs by modifying them in such a way as to include a (possibly evolved) copy of itself."

The computer virus has certainly evolved since the Creeper scared users. Below are some of the key moments in the history of the computer virus.

Computer viruses through the years
  • 1949 — Hungarian scientist John von Neumann develops the theory of a self-replicating program.
  • Early 1970s — The Creeper virus is found on the ARPANET, a forerunner of the Internet. It gains access to computers via a modem and copies itself. Another virus, the Reaper, was created to delete the Creeper.
  • 1974 — Rabbit viruses appear. They clone themselves rapidly, hence the name. The viruses occupy system resources. They usually do not copy themselves from system to system.
  • 1979 — Xerox engineers discover the computer "worm." This short program scours a network for idle processors. While it was designed to provide more efficient computer use, this worm is the ancestor of modern worms, which can be destructive.
  • 1982 — Richard Skrenta writes "Elk Cloner," one of the first viruses that spread "in the wild," meaning outside the system or lab it was written in. Created as a joke by the high school student, it attached itself to the Apple DOS 3.3 operating system and was spread by a floppy disk. On the 50th time and every 50 times afterward, a short poem was displayed. It included the following lines: "Elk Cloner: The program with a personality. It will get on all your disks. It will infiltrate your chips. Yes it's Cloner!"
  • 1983 — Doctoral student Fred Cohen coins the term "computer virus." His research is later used by anti-virus makers.
  • 1986 — "The Brain," one of the first PC viruses, is created by programmers in Pakistan.
  • 1987 — Various viruses appear including Lehigh and boot viruses such as "Yale" from the U.S., "Stoned" from New Zealand, "Ping Pong" from Italy and "Cascade," the first self-encrypting file virus. A Cascade infection in IBM's Belgium office led to the company's anti-virus product development.
  • 1988 — Out of boredom, Robert Morris, 23, creates a worm that invades ARPANET computers. The small program disables about 6,000 computers by filling up their memory banks with copies. Morris receives a $10,000 fine and three years probation for his deed.
  • 1988 — Created in 1987, the "Jerusalem" virus makes its presence well known a year later. On every Friday the 13th, starting with May 13, 1988, the virus destroys all executable files on infected machines.
  • 1994 — An email travels around the world warning people not to open a message with "Good Times" in the subject line. The email warns of a virus that can erase the recipient's hard drive. It turns out to be a hoax.
  • 1995 — The "Word Concept" virus became prevalent in the mid-1990s. Spread through Microsoft Word documents it does not cause data loss, but only allowed users to save their work as templates.
  • 1999 — The infamous "Melissa" virus causes an estimated $80 million in damages as anti-virus products fly off the shelves. Melissa sends copies of itself to the first 50 names on the recipient's Outlook e-mail address book and mails out infected Microsoft Word documents from the user's hard drive.
  • 1999 - "Bubble Boy" was the first worm that did not need the recipient to open an attachment in order for it to go to work. As soon as the email was opened, "Bubble Boy" began making copies of itself and sending them out. It also changed the name of the computer's registered owner and company to "Bubble Boy" and "Vandelay Industries," which are references to the Seinfeld TV show.
  • 2000 — The "I Love You" virus quickly infects millions of computers. As well as emailing copies of itself, it sends passwords and usernames back to its creator, a Filipino computer student. As the Philippines have no laws regarding spreading viruses, the man goes free. This prompts the European Union's Cybercrime Treaty.
  • 2000 - Amazon, eBay, Yahoo and other high-profile websites are knocked offline due to a "distributed denial-of-service attacks." In a DDOS attack the system is flooded by traffic from hundreds of computers at the same time. Hackers co-opted powerful computers at the University of California-Santa Barbara to make their attack.
  • 2001 — It was not just tennis fans who fell victim to the "Anna Kournikova" virus. When users opened the message, which promised pictures of the tennis star, the virus mailed copies of itself to everyone on the victims' Outlook address book. Although relatively benign, the virus scared computer security analysts as it was thought it was created using a "toolkit" that would allow even inexperienced programmers to create a virus.
  • 2001- The "Code Red" worm causes an estimated $2 billion in damage while infecting tens of thousands of systems. It is programmed to use the power of all the infected computers against the United States' White House website at a predetermined date. In cooperation with virus hunters and technology companies, the White House deciphers the worm's code and blocks the traffic.
  • 2001 — The sophisticated "Nimda" virus infects hundreds of thousands of computers just days after the Sept. 11 attacks. It has up to five methods of infecting systems and replicating itself.
  • 2001 — "Melissa" virus author David L. Smith, 33, receives a 20-month sentence in federal prison.
  • 2002 — The "Klez" worm is launched. Like "Melissa," it will send copies of itself to addresses in a victim's Outlook directory. However, it also can overwrite files and create hidden copies of originals and fill documents with all zeroes. The worm attempted to disable some common anti-virus products.
  • 2003 — Cash machines were knocked offline and airline flights were delayed because of the "Slammer." One of the fastest-spreading worms ever, the "Slammer" infected hundreds of thousands of computers in less than three hours.
  • 2004 — The "MyDoom" worm employs social engineering to persuade users to open it. The email message claims to be a notification that an earlier email message failed. It prompts the user to open the attachment, which releases the virus.
  • 2007 — Computers are hit by the "Storm Worm." This fast-spreading email spammer disguises itself as a news email and asks you to download film. The "Storm Worm" gathers infected computers into a Storm botnet, which it uses to infect other machines. It was first identified on Jan. 17 and by June 30 had infected 1.7 million computers.

What will the future hold for viruses? We have already seen network viruses, which use network protocols and commands for spreading. It appears more effort is being made to create viruses that cover their tracks. This might not seem like a bright future, however with each new technique in malicious software, anti-virus technology grows and advances to compensate.

Microsoft is a registered trademark of Microsoft Corporation in the United States and/or other countries.