Free demo · Information Security · Lesson 4 · Phase 2 · Viruses

What is a computer virus, and where did it come from?

A computer virus is a program that attaches itself to other files and copies itself when they run, like a biological virus using a cell. The first ones were experiments and pranks; later ones cost billions.

  1. 1971 · CreeperBob Thomas's experiment moved between ARPANET machines and printed “I'm the creeper, catch me if you can!”. Reaper, written to remove it, was the first antivirus.
  2. 1982 · Elk ClonerA 15-year-old, Rich Skrenta, wrote it as a prank; it spread on Apple II floppy disks and showed a poem every 50th boot. The first virus “in the wild”.
  3. 1986 · BrainThe first IBM PC virus, written in Lahore by two brothers to track pirated copies of their software. It infected the boot sector of floppies.
  4. 1988 · Morris wormA student's self-spreading program infected about 6,000 machines, roughly 10% of the internet then, and caused the first conviction under the US Computer Fraud and Abuse Act.
  5. 2000 · ILOVEYOUAn e-mail attachment named LOVE-LETTER-FOR-YOU.txt.vbs overwrote files and mailed itself to every contact: an estimated 45 million PCs and about US$10 billion of damage.
  6. 2017 · WannaCryRansomware using a leaked Windows exploit locked about 230,000 computers in 150 countries in one day, including UK hospital systems. A patch had existed for two months.

Every virus needs three things

A host to hide in (a file, a boot sector, a document macro), a way to copy itself (floppies, e-mail, USB, networks, chats) and a payload (a poem, deleted files, stolen data or a ransom note).

Break any link and the virus fails: don't open unknown attachments, keep software updated, and keep a backup.

  1. 1
  2. 2
  3. 3
  4. 4
  5. 5
  6. 6
  7. 7
  8. 8
  9. 9
  10. Enrol

Tip: press → or Space to step through, ← to go back, R to replay.

About this lesson

A computer virus is malicious code that attaches to a host such as a program, a boot sector or an Office document and replicates when the host runs, usually carrying a payload. The idea was proven in 1971 by Creeper on ARPANET and its remover Reaper, the first antivirus. Elk Cloner (1982) was the first virus in the wild, Brain (1986) the first PC virus, and the Morris worm (1988) the first internet-scale outbreak, infecting about 6,000 machines. ILOVEYOU (2000) spread by e-mail to tens of millions of PCs, and WannaCry (2017) showed how ransomware can shut down hospitals and factories worldwide within hours. Phase 2 of the full course also covers Melissa, SQL Slammer, Mydoom, Conficker, Stuxnet, NotPetya, Emotet and 2026 cases such as the CyberDakait Android banking malware targeting Indian banks.

Key points

  • Definition: host, replication, payload
  • Creeper, Elk Cloner, Brain and the Morris worm
  • ILOVEYOU and WannaCry: the cost of ignoring updates