John von Neumann's article on the "Theory of self-reproducing automata" is published.
The article is based on lectures given by von Neumann at the
University of Illinois about the "Theory and Organization of Complicated Automata" in 1949.
Creeper virus, an experimental self-replicating program, is written by Bob Thomas at
BBN Technologies. Creeper infected DEC
PDP-10 computers running the
TENEX operating system. Creeper gained access via the
ARPANET and copied itself to the remote system where the message, "I'm the creeper, catch me if you can!" was displayed. The
Reaper program was later created to delete Creeper.
The Rabbit (or Wabbit) virus, more a
fork bomb than a virus, is written. The Rabbit virus makes multiple copies of itself on a single computer (and was named "Rabbit" for the speed at which it did so) until it clogs the system,
reducing system performance, before finally reaching a threshold and crashing the computer.
April: ANIMAL is written by
John Walker for the
ANIMAL asked a number of questions of the user in an attempt to guess the type of animal that the user was thinking of, while the related program PERVADE would create a copy of itself and ANIMAL in every directory to which the current user had access. It spread
across the multi-user UNIVACs when users with overlapping permissions discovered the game, and to other computers when tapes were shared. The program was carefully written to avoid damage to existing file or directory structures, and not to copy itself if
permissions did not exist or if damage could result. Its spread was therefore halted by an OS upgrade which changed the format of the file status tables that PERVADE used for safe copying. Though non-malicious, "Pervading Animal" represents the first
Trojan "in the wild".
A program called
Elk Cloner, written for
Apple II systems, was created by
Richard Skrenta. The Apple II was seen as particularly vulnerable due to the storage of its operating system on
floppy disk. Elk Cloner's design combined with public ignorance about what
malware was and how to protect against it led to Elk Cloner being responsible for the first large-scale computer virus outbreak in history.
November: The term 'virus' is coined by
Frederick Cohen in describing self-replicating computer programs. In 1984 Cohen uses the phrase "computer virus" – as suggested by his teacher
Leonard Adleman – to describe the operation of such programs in terms of "infection". He defines a 'virus' as "a program that can 'infect' other programs by modifying them to
include a possibly evolved copy of itself." Cohen demonstrates a virus-like program on a
VAX11/750 system at
Lehigh University. The program could install itself in, or infect, other system objects.
A very early Trojan Horse designed for the IBM PC called ARF-ARF was downloaded from BBS sites and claimed to “Sort” the DOS Diskette Directory. This was a very desirable feature because DOS didn’t list the files in alphabetical order in 1983. Instead,
the program deleted all of the files on the diskette, cleared the screen and typed ARF – ARF. ARF was a reference to the common “Abort, Retry Fail” message you would get when a PC could not boot from a diskette.[citation
Ken Thompson publishes his seminal paper, Reflections on Trusting Trust, in which he describes how he modified a
Ccompiler so that when used to compile a specific version of the
Unix operating system, it inserted a
backdoor into the
login command, and when used to compile itself, it inserted the backdoor insertion code, even if neither the backdoor nor the backdoor insertion code were present in the
boot sector virus is released. Brain is considered the first
IBM PC compatible virus, and the program responsible for the first IBM PC compatible virus epidemic. The virus is also known as Lahore, Pakistani, Pakistani Brain, and Pakistani flu as it was created in Lahore, Pakistan by 19 year old Pakistani programmer,
Basit Farooq Alvi, and his brother, Amjad Farooq Alvi.
December: Ralf Burger presented the Virdem model of programs at a meeting of the underground
Chaos Computer Club in Germany. The Virdem model represented the first programs that could replicate themselves via addition of their code to executable DOS files in COM format.
Appearance of the Vienna virus, which was subsequently neutralized—the first time this had happened on the IBM platform.
Appearance of Lehigh virus, boot sector viruses such as Yale from USA,
Stoned from New Zealand,
Ping Pong from Italy, and appearance of first self-encrypting file virus,
Cascade. Lehigh was stopped on campus before it spread to the wild, and has never been found elsewhere as a result. A subsequent infection of Cascade in the offices of IBM Belgium led to IBM responding with its own antivirus product development. Prior to
this, antivirus solutions developed at IBM were intended for staff use only.
Jerusalem virus, part of the (at that time unknown) Suriv family, is detected in the city of
Jerusalem. The virus destroys all executable files on infected machines upon every occurrence of Friday the 13th (except Friday 13 November 1987 making its first trigger date May 13, 1988).
Jerusalem caused a worldwide epidemic in 1988.
SCA virus, a boot sector virus for
Amigas appears, immediately creating a pandemic virus-writer storm. A short time later,
SCA releases another, considerably more destructive virus, the
Christmas Tree EXEC was the first widely disruptive replicating network program, which paralyzed several international computer networks in December 1987.
March 1: The
Ping-Pong virus (also called Boot, Bouncing Ball, Bouncing Dot, Italian, Italian-A or VeraCruz), an MS-DOS boot sector virus, is discovered at
University of Turin in Italy.
CyberAIDS and Festering Hate
Apple ProDOS viruses spreads from underground pirate BBS systems and starts infecting mainstream networks. Festering Hate was the last iteration of the CyberAIDS series extending back to 1985 and 1986. Unlike the few Apple viruses that had come before which
were essentially annoying, but did no damage, the Festering Hate series of viruses was extremely destructive, spreading to all system files it could find on the host computer (hard drive, floppy, and system memory) and then destroying everything when it could
no longer find any uninfected files.
Ghostball, the first
multipartite virus, is discovered by
Friðrik Skúlason. It infects both executable .COM-files and boot sectors on MS-DOS systems. It captures certain information entered or saved by the user, with the corresponding threat to privacy, causes the loss of information stored on the computer, either
specific files or data in general, affects the productivity of the computer, the network to which it’s connected or other remote sites, decrease the security level of the computer, but does not automatically spread itself.
Mark Washburn working on an analysis of the Vienna and Cascade viruses with Ralf Burger develops the first family of
polymorphic virus: the Chameleon family. Chameleon series debuted with the release of
Michelangelo virus was expected to create a digital apocalypse on March 6, with millions of computers having their information wiped according to mass media hysteria surrounding the virus. Later assessments of the damage showed the aftermath to be minimal.
John McAfee had been quoted by the media as saying that 5 million computers would be affected. He later said that, pressed by the interviewer to come up with a number, he had estimated a range from 5 thousand to 5 million, but the media naturally went with
just the higher number.
December 30: The
May: The ILOVEYOU worm, also known as Love Letter, or VBS, or Love Bug worm, is a computer worm purportedly created by a
Filipino computer science student. Written in VBScript, it infected millions of Windows computers worldwide within a few hours of its release. It is considered to be one of the
most damaging worms ever.
Beast is a Windows-based backdoor Trojan horse, more commonly known as a RAT (Remote Administration Tool). It is capable of
infecting almost all versions of Windows. Written in Delphi and released first by its author Tataye in 2002, its most current version was released October 3, 2004
Mylife is a computer worm that spread itself by sending malicious emails to all the contacts in Microsoft Outlook.
Optix Pro is a configurable remote access tool or trojan, similar to SubSeven or BO2K.
January 24: The
SQL slammer worm, aka Sapphire worm, Helkern and other names, attacks vulnerabilities in
Microsoft SQL Server and
MSDE becomes the fastest spreading worm of all time (measured by doubling time at the peak rate of growth),
crashing the Internet within 15 minutes of release.
April 2: Graybird is a trojan horse also known as Backdoor.Graybird.
June 13: ProRat is a Turkish-made Microsoft Windows based backdoor trojan horse, more commonly known as a RAT (Remote Administration Tool).
August 12: The
Blaster worm, aka the Lovesan worm, rapidly spreads by exploiting a vulnerability in system services present on Windows computers.
August 18: The
Welchia (Nachi) worm is discovered. The worm tries to remove the blaster worm and patch Windows.
August 19: The
Sobig worm (technically the
Sobig.F worm) spreads rapidly through Microsoft systems via mail and network shares.
September 18: Swen is a computer worm written in C++.
October 24: The
Sober worm is first seen on Microsoft systems and maintains its presence until 2005 with many new variants. The simultaneous attacks on network weakpoints by the Blaster and Sobig worms cause massive damage.
November 10: Agobot is a computer worm that can spread itself by exploiting vulnerabilities on Microsoft Windows. Some of the vulnerabilities are MS03-026 and MS05-039.
November 20: Bolgimo is a computer worm that spread itself by exploiting a buffer overflow vulnerability at Microsoft Windows DCOM RPC Interface.
Bagle is a mass-mailing worm affecting all versions of Microsoft Windows. There were 2 variants of Bagle worm, Bagle.A and Bagle.B. Bagle.B was discovered on February 17, 2004.
January 23: The L10n worm (usually pronounced "lion") was a Linux worm that spread by exploiting a buffer overflow in the BIND DNS server. It was based on an earlier worm known as the Ramen worm (commonly, albeit incorrectly referred to as the Ramen Virus)
which was written to target systems running versions 6.2 and 7.0 of the Red Hat Linux distribution.
Late January: The
MyDoom worm emerges, and currently holds the record for the fastest-spreading mass mailer worm.
February 16: The
Netsky worm is discovered. The worm spreads by email and by copying itself to folders on the local hard drive as well as on mapped network drives if available. Many variants of the Netsky worm appeared.
March 19: The
Witty worm is a record-breaking worm in many regards. It exploited holes in several
Internet Security Systems (ISS) products. It was the fastest disclosure to worm, it was the first internet worm to carry a destructive payload and it spread rapidly using a pre-populated list of ground-zero hosts.
May 1: The
Sasser worm emerges by exploiting a vulnerability in the Microsoft Windows
LSASS service and causes problems in networks, while removing
Bagle variants, even interrupting business.
Caribe or Cabir is a computer worm that is designed to infect mobile phones that run
Symbian OS. It is the first computer worm that can infect mobile phones. It spread itself through
Bluetooth. More information can be found on
August 20: Vundo, or the Vundo Trojan (also known as Virtumonde or Virtumondo and sometimes referred to as MS Juan) is a trojan known to cause popups and advertising for rogue antispyware programs,
and sporadically other misbehaviour including performance degradation and denial of service with some websites including
Bifrost, also known as Bifrose, is a backdoor trojan which can infect
Windows 95 through
Vista. Bifrost uses the typical server, server builder, and client backdoor program configuration to allow a remote attack.
December: Santy, the first known "webworm" is launched. It exploited a vulnerability in
phpBB and used
Google in order to find new targets. It infected around 40000 sites before Google filtered the search query used by the worm, preventing it from spreading.
Late 2005: The
Zlob Trojan, is a trojan horse which masquerades as a required video codec in the form of the Microsoft Windows ActiveX component. It was first detected in late 2005.
Bandook or Bandook Rat (Bandook Remote Administration Tool) is a backdoor trojan horse that infects the Windows family. It uses a server creator, a client and a server to take control over
the remote computer. It uses process hijacking / kernel patching to bypass the firewall, and let the server component hijack processes and gain rights for accessing the Internet.
January 20: The
Nyxem worm was discovered. It spread by mass-mailing. Its payload, which activates on the third of every month, starting on February 3, attempts to disable security-related and file sharing software, and destroy files of certain types, such as Microsoft
February 16: discovery of the first-ever malware for Mac OS X, a low-threat trojan-horse known as OSX/Leap-A or OSX/Oompa-A, is announced.
Late March: Brontok variant N was found in late March.
Brontok was a mass-email worm and the origin for the worm was from Indonesia.
Stration or Warezov worm first discovered.
Storm Worm identified as a fast spreading email spamming threat to Microsoft systems. It begins gathering infected computers into the
Storm botnet. By around June 30 it had infected 1.7 million computers, and it had compromised between 1 and 10 million computers by September.
Thought to have originated from Russia, it disguises itself as a news email containing a film about bogus news stories asking you to download the attachment which it claims is a film.
Zeus is a trojan that targets Microsoft Windows to steal banking information by keystroke logging.
February 17: Mocmex is a trojan, which was found in a digital photo frame in February 2008. It was the first serious computer virus on a digital photo frame. The virus was traced back to a
group in China.
March 3: Torpig, also known as Sinowal and Mebroot, is a Trojan horse that affects Windows, turning off anti-virus applications. It allows others to access the computer, modifies data, steals
confidential information (such as user passwords and other sensitive data) and installs more malware on the victim's computer.
May 6: Rustock.C, a hitherto-rumoured spambot-type malware with advanced rootkit capabilities, was announced to have been detected on Microsoft systems and analyzed, having been in the wild and undetected since October 2007 at the very least.
July 6: Bohmini.A is a configurable remote access tool or trojan that exploits security flaws in Adobe Flash 9.0.115 with Internet Explorer 7.0 and Firefox 2.0 under Windows XP SP2.
November 21: Computer worm
Conficker infects anywhere from 9 to 15 million Microsoft server systems running everything from
Windows 2000 to the
Windows 7 Beta. The French Navy,
UK Ministry of Defence (including Royal Navy warships and submarines), Sheffield Hospital
Bundeswehr and Norwegian
Police were all affected.
Microsoft sets a bounty of $250,000
USD for information leading to the capture of the worm's author(s). Five main variants
of the Conficker worm are known and have been dubbed Conficker A, B, C, D and E. They were discovered 21 November 2008, 29 December 2008, 20 February 2009, 4 March 2009 and 7 April 2009, respectively. On December 16, 2008, Microsoft releases KB958644
 patching the server service vulnerability responsible for the spread of Conficker.
July 15: Symantec discovered
Daprosy Worm. Said trojan worm is intended to steal online-game passwords in internet cafes. It could, in fact, intercept all keystrokes and send them to its author which makes it potentially a very dangerous worm to infect
B2B (business-to-business) systems.
2010 and later
January: A botnet called
Waledac sent spam emails. In February 2010, an international group of security researchers and Microsoft took Waledac down.
June 17: Stuxnet, a Windows trojan, was detected.
It is the first worm to attack
SCADA systems. There are suggestions that it was designed to target
Iranian nuclear facilities. It uses a valid certificate from
September 9: The virus, called "here you have" or "VBMania", is a simple trojan horse that arrives in the inbox with the odd-but-suggestive subject line "here you have". The
body reads "This is The Document I told you about, you can find it Here" or "This is The Free Download Sex Movies, you can find it Here".
September 15: The virus called
Kenzero is a virus that spreads online from Peer to peer (P2P) sites taking browsing history.
Anti-Spyware 2011, a trojan horse which attacks Windows 9x, 2000, XP, Vista, and Windows 7, posing as an anti-spyware program. It actually disables security-related process of anti-virus programs, while also blocking access to the Internet which prevents
Summer 2011: The Morto worm attempts to propagate itself to additional computers via the Microsoft Windows
Remote Desktop Protocol (RDP). Morto spreads by forcing infected systems to scan for Windows servers allowing RDP login. Once Morto finds an RDP-accessible system, it attempts to log into a domain or local system account named 'Administrator' using a number
of common passwords. A detailed overview of how the worm works—along with the
password dictionary Morto uses—was done by
July 13: the Zeroaccess Rootkit or Max++ was discovered.
Flame also known as Flamer, sKyWIper, and Skywiper is modular computer malware discovered in 2012 that attacks computers running Microsoft Windows. The program is being used for targeted cyber espionage in Middle Eastern countries. Its discovery was announced
on 28 May 2012 by MAHER Center of Iranian National Computer Emergency Response Team (CERT), Kaspersky Lab and CrySyS Lab of the Budapest University of Technology and Economics. CrySyS stated in their report that "sKyWIper is certainly the most sophisticated
malware we encountered during our practice; arguably, it is the most complex malware ever found".
August 16: Shamoon is a computer virus designed to target computers running Microsoft Windows in the energy sector. Symantec, Kaspersky Lab, and Seculert announced its discovery on August
September 20: NGRBot is a worm that uses the IRC network for file transfer, sending and receiving commands between zombie network machines and the attacker’s IRC server, and monitoring and controlling network connectivity and intercept. It employs a user-mode
rootkit technique to hide and steal its victim’s information. This family of bot is also designed to infect HTML pages with iframes, causing redirections, blocking victims from getting updates from security/antimalware products, and killing those services.
The bot is designed to connect via a predefined IRC channel and communicate with a remote botnet.