What counts as a virus
People often use “virus” for any harmful program, but the terms have narrower meanings. A virus, in the sense most researchers use, is code that attaches itself to something else, such as another program or the startup area of a disk, and copies itself when that host is used. A worm is a program that spreads on its own across a network without needing a host file. A trojan pretends to be something useful. “Malware” is the umbrella word for all of them.
These definitions blur in practice, and the history is easier to follow if you keep that in mind. Several of the best-known early programs would be classed differently depending on whom you ask.
Ideas before the machines were everywhere
The theory came first. In the late 1940s the mathematician John von Neumann lectured on machines that could build copies of themselves, a line of thought that was published after his death as a work on self-reproducing automata. He was interested in biology and logic, not security. Still, the idea that a program is just data, and so can be copied by another program, sits underneath everything that followed. The stored-program design of early electronic computers made that possible.
Fiction played a part too. Novels of the 1970s imagined self-spreading programs moving through networks, and some of those books helped popularize the vocabulary, though the details of who borrowed what are debated.
Experiments on networks in the 1970s
The first programs that moved between machines were experiments. The Creeper program, written around 1971 on a research network that grew out of ARPANET, hopped between computers and printed a taunting message. A companion program called Reaper was written to hunt it down. Neither was meant to cause damage, and a few years later, researchers at Xerox’s Palo Alto lab wrote “worm” programs to use idle machines for useful work, learning along the way how easily such code could get out of hand.
The floppy-disk era
Personal computers changed the picture. In the early 1980s, hobbyists and small businesses swapped programs on floppy disks, often copied without payment. A disk was a perfect carrier: whatever was on its startup area ran automatically when the machine booted.
Elk Cloner, written for the Apple II in 1982 by a teenager, is often described as one of the first viruses to spread outside a lab. It was a prank, showing a short poem on certain startups. Brain, a boot-sector virus for IBM-compatible PCs that appeared in 1986, spread much further, carried on copied disks around the world. In the same period, Fred Cohen, a graduate student, demonstrated on a university system that a self-spreading program could cross security boundaries and wrote about it; he is often credited with giving “computer virus” its formal definition. By the late 1980s there were dozens of viruses, including ones that deleted files on certain dates.
Spread was slow by modern standards. An infection moved at the speed that people carried disks, which meant weeks or months rather than minutes. That slow pace gave early antivirus makers time to catch up, and it is part of why the field began as a cottage industry.
The 1988 turning point
In November 1988 a program now called the Morris worm spread across the early internet, which then linked roughly tens of thousands of computers. It was written by a graduate student, who said he meant it to be harmless, but a flaw in how it decided whether to copy itself caused machines to be reinfected again and again until they slowed to a crawl. It made the case that a network was a shared risk, and it led directly to the creation of a coordination center for emergency response. It also produced one of the first prosecutions under the US computer fraud law.
Email, macros and the web
Through the 1990s, the preferred carrier changed along with the way people shared files. Word processors and spreadsheets gained macro languages, so documents themselves could carry code; the Concept virus of 1995 is a common example. Email attachments then made it simple for a program to forward itself to a victim’s address book. Melissa in 1999 and ILOVEYOU in 2000 spread this way and overloaded mail servers at many organizations within a day or two.
Then came worms that needed no human action at all. Code Red in 2001 and Slammer in 2003 exploited flaws in server software and, in the case of Slammer, reportedly reached most vulnerable machines within minutes. The growth of home broadband and the spread of web browsers put millions of poorly protected machines online, and attackers started noticing what those machines were worth.
Why motives matter
The early programs were jokes, experiments and vandalism. Over time the aim shifted toward money: building networks of hijacked computers for spam, stealing banking logins, and eventually locking files for ransom. A few cases, such as the Stuxnet worm found in 2010, are widely attributed to government-backed teams with specific industrial targets. Those changes are covered in more detail in other articles in this series.
How the field of defense took shape
Each wave forced a response. Antivirus scanners appeared in the late 1980s to match known code. Operating systems added permission systems, and later automatic updates, so that a single flaw could be patched for everyone. Organizations began to separate their internal networks from the wider internet with filtering gateways. Researchers learned to share samples and warnings, which is why incident response teams now exist at companies and national levels.
None of this ended the problem. Defenders tend to respond to what attackers have already done, and new platforms, from smartphones to cloud computing, have each had to learn the lessons again. What the history does show is that the pattern repeats: every convenient way of sharing software or data has eventually been used to spread malicious code, and security has usually improved most quickly after a visible, expensive failure.