This timeline of computer viruses and worms presents a chronological timeline of noteworthy computer viruses, computer worms, Trojan horses, similar malware, related research and events.
1960s 1966 John von Neumann's article on the "Theory of self-reproducing automata" is published in 1966. The article is based on lectures given by von Neumann at the University of Illinois about the "Theory and Organization of Complicated Automata" in 1949.
1970s
1970 The first story written about a computer virus, The Scarred Man by Gregory Benford, was published in the May 1970 issue of Venture Science Fiction.
1971 The Creeper system, an experimental self-replicating program, is written by Bob Thomas at BBN Technologies to test John von Neumann's theory. Creeper infected DEC PDP-10 computers running the TENEX operating system. Creeper gained access via the ARPANET and copied itself to the remote system where the message "I'm the creeper : catch me if you can!" was displayed. The Reaper program was later created to delete Creeper. At the University of Illinois at Urbana-Champaign, a graduate student named Alan Davis (working for Prof. Donald Gillies) created a process on a PDP-11 that (a) checked to see if an identical copy of itself was currently running as an active process, and if not, created a copy of itself and started it running; (b) checked to see if any disk space (which all users shared) was available, and if so, created a file the size of that space; and (c) looped back to step (a). As a result, the process stole all available disk space. When users tried to save files, the operating system advised them that the disk was full and that they needed to delete some existing files. Of course, if they did delete a file, this process would immediately snatch up the available space. When users called in a system administrator to fix the problem, he examined the active processes, discovered the offending process, and deleted it. Of course, before he left the room, the still existing process would create another copy of itself, and the problem would not go away. The only way to make the computer work again was to reboot.
1972 The science fiction novel, When HARLIE Was One, by David Gerrold, contains one of the first fictional representations of a computer virus, as well as one of the first uses of the word "virus" to denote a program that infects a computer.
1973 In fiction, the 1973 Michael Crichton movie Westworld made an early mention of the concept of a computer virus, being a central plot theme that causes androids to run amok. Alan Oppenheimer's character summarizes the problem by stating that a clear pattern here which suggests an analogy to an infectious disease process, spreading from one[...] area to the next." To which the replies are stated: "Perhaps there are superficial similarities to disease" and, "I must confess I find it difficult to believe in a disease of machinery."
1974 The Rabbit (or Wabbit) virus, more a fork bomb than a virus, is written. The Rabbit virus makes multiple copies of itself on a single computer (and was named "rabbit" for the speed at which it did so) until it clogs the system, reducing system performance, before finally reaching a threshold and crashing the computer."The very first viruses: Creeper, Wabbit and Brain", Daniel Snyder, InfoCarnivore, May 30, 2010,
1975 April: ANIMAL is written by John Walker for the UNIVAC 1108. ANIMAL asked several questions of the user in an attempt to guess the type of animal the user was thinking of, while the related program PERVADE would create a copy of itself and ANIMAL in every directory to which the current user had access. It spread across the multi-user UNIVACs when users with overlapping permissions discovered the game, and to other computers when tapes were shared. The program was carefully written to avoid damaging existing file or directory structures, and to avoid copying itself if permissions did not exist or if harm would result. Its spread was halted by an OS upgrade that changed the format of the file status tables PERVADE used. Though non-malicious, "Pervading Animal" represents the first Trojan "in the wild". The novel The Shockwave Rider by John Brunner is published, coining the word "worm" to describe a program that propagates itself through a computer network.
1977 The Adolescence of P-1 novel, describes a worm program that propagates through modem-based networks, eventually developing its own strategy-developing AI, which deals with cross-hardware and cross-os issues, eventually infecting hardware manufactures and defense organizations.
1980s
1982 A program called Elk Cloner, written for Apple II systems, was created by Mt. Lebanon High School student Richard Skrenta, originally as a prank. The Apple II was particularly vulnerable due to the need for a floppy disk to be present in order to bootstrap the computer. Elk Cloner's design combined with the public's general lack of knowledge regarding malware and how to protect against it led to Elk Cloner being responsible for the first computer virus outbreak in history.
1983 November: The term "virus" is re-coined by Frederick B. Cohen in describing self-replicating computer programs. In 1984 Cohen uses the phrase "computer virus" (suggested by his teacher Leonard Adleman) to describe the operation of such programs in terms of "infection". He defines a "virus" as "a program that can 'infect' other programs by modifying them to include a possibly evolved copy of itself." Cohen demonstrates a virus-like program on a VAX11/750 system at Lehigh University. The program could install itself in, or infect, other system objects.
1984 August: Ken Thompson publishes his seminal paper, "Reflections on Trusting Trust", in which he describes how he modified a C compiler so that when used to compile a specific version of the Unix operating system, it inserts a backdoor into the login command, and when used to compile a new copy of itself, it inserts the backdoor insertion code, even if neither the backdoor nor the backdoor insertion code is present in the source code of this new copy.
1986 January: The Brain boot sector virus is released. Brain is considered the first IBM PC compatible virus, and the program responsible for the first IBM PC compatible virus epidemic. The virus is also known as Lahore, Pakistani, Pakistani Brain, and Pakistani flu as it was created in Lahore, Pakistan, by 19-year-old Pakistani programmer Basit Farooq Alvi and his brother, Amjad Farooq Alvi. December: Ralf Burger presented the Virdem model of programs at a meeting of the underground Chaos Computer Club in Germany. The Virdem model represented the first programs that could replicate themselves via addition of their code to executable DOS files in COM format.
1987 Appearance of the Vienna virus, which was subsequently neutralized – the first time this had happened on the IBM platform. Appearance of Lehigh virus (discovered at its namesake university), boot sector viruses such as Yale from the US, Stoned from New Zealand, Ping Pong from Italy, and appearance of the first self-encrypting file virus, Cascade. Lehigh was stopped on campus before it spread to the "wild" (to computers beyond the university), and as a result, has never been found elsewhere. A subsequent infection of Cascade in the offices of IBM Belgium led to IBM responding with its own antivirus product development. Prior to this, antivirus solutions developed at IBM were intended for staff use only. October: The Jerusalem virus, part of the (at that time unknown) Suriv family, is detected in the city of Jerusalem. The virus destroys all executable files on infected machines upon every occurrence of Friday the 13th (except Friday 13 November 1987 making its first trigger date May 13, 1988). Jerusalem caused a worldwide epidemic in 1988. November: The SCA virus, a boot sector virus for Amiga computers, appears. It immediately creates a pandemic virus-writer storm. A short time later, SCA releases another, considerably more destructive virus, the Byte Bandit. December: Christmas Tree EXEC was the first widely disruptive replicating network program, which paralyzed several international computer networks in December 1987. It was written in Rexx on the VM/CMS operating system and originated in West Germany. It re-emerged in 1990.
1988 March 1: The Ping-Pong virus (also called Boot, Bouncing Ball, Bouncing Dot, Italian, Italian-A or VeraCruz), an MS-DOS boot sector virus, is discovered at the University of Turin in Italy. June: The CyberAIDS and Festering Hate Apple ProDOS viruses spreads from underground pirate BBS systems and starts infecting mainstream networks. Festering Hate was the last iteration of the CyberAIDS series extending back to 1985 and 1986. Unlike the few Apple viruses that had come before which were essentially annoying, but did no damage, the Festering Hate series of viruses was extremely destructive, spreading to all system files it could find on the host computer (hard drive, floppy, and system memory) and then destroying everything when it could no longer find any uninfected files. November 2: The Morris worm, created by Robert Tappan Morris, infects DEC VAX and Sun machines running BSD UNIX that are connected to the Internet, and becomes the first worm to spread extensively "in the wild", and one of the first well-known programs exploiting buffer overrun vulnerabilities. December: The Father Christmas worm attacks DEC VAX machines running VMS that are connected to the DECnet Internet (an international scientific research network using DECnet protocols), affecting NASA and other research centers. Its purpose was to deliver a Christmas greeting to all affected users.
1989 October: Ghostball, the first multipartite virus, is discovered by Friðrik Skúlason. It infects both executable .COM files and boot sectors on MS-DOS systems. December: Several thousand floppy disks containing the AIDS Trojan, the first known ransomware, are mailed to subscribers of PC Business World magazine and a WHO AIDS conference mailing list. This DOS Trojan lies dormant for 90 boot cycles, then encrypts all filenames on the system, displaying a notice asking for $189 to be sent to a post office box in Panama in order to receive a decryption program.
1990s
1990 Mark Washburn, working on an analysis of the Vienna and Cascade viruses with Ralf Burger, develops the first family of polymorphic viruses, the Chameleon family. Chameleon series debuted with the release of 1260. June: The Form computer virus is isolated in Switzerland. It would remain in the wild for almost 20 years and reappear afterward; during the 1990s it tended to be the most common virus in the wild with 20 to more than 50 percent of reported infections.
1991 Mattel releases a toyline called "Computer Warriors," bringing computer viruses into mainstream media. The villain, Megahert, is a sentient computer virus.
1992 March: The Michelangelo virus was expected to create a digital apocalypse on March 6, with millions of computers having their information wiped, according to mass media hysteria surrounding the virus. Later assessments of the damage showed the aftermath to be minimal. John McAfee had been quoted by the media as saying that five million computers would be affected. He later said that pressed by the interviewer to come up with a number, he had estimated a range from five thousand to five million, but the media naturally went with just the higher number. October: Milton-Bradley releases Omega Virus, a board game containing one of the first examples of a sentient computer virus in mainstream media.
1993