How to read this timeline
Dates for the earliest programs come from papers, memoirs and later retellings, and not every detail is firmly documented. Where an entry is disputed or based mainly on recollection, the text says so. The point of the list is the sequence, because it shows how each era’s habits for sharing software created the next era’s infections.
Before 1970: ideas only
In the late 1940s John von Neumann lectured on machines that could build copies of themselves. The lectures were published after his death. At the time, electronic computers were few, and nobody was talking about security. Reports say that in 1961 programmers at Bell Labs invented a game in which programs fought over memory, a forerunner of Core War, but the accounts are loosely documented.
The 1970s: experiments on shared machines
- About 1971: The Creeper program moves between computers on an early research network, printing a taunting message. A program usually called Reaper is written to find and delete it.
- Mid-1970s: Small programs that copy themselves to exhaust a system’s capacity, often called rabbits, are described by operators of large computers. A game program that spread by copying itself to the shared directories of other users on a multi-user machine is also reported, though sources vary on its details.
- 1975: A science-fiction novel, The Shockwave Rider, describes a self-spreading “tapeworm” program.
- Late 1970s: Researchers at Xerox begin experiments with worm programs that use idle machines on a local network, later published in 1982.
All of this was done by professionals, mostly in laboratories, and the programs were not intended to be harmful.
The 1980s: floppy disks and the first alarms
- 1982: Elk Cloner, a prank by a teenager, spreads among Apple II users on boot disks. The Xerox worm experiments are published.
- 1983: Fred Cohen demonstrates a controlled virus experiment on a Unix system, and the term “computer virus” enters technical use.
- 1984: A magazine column introduces Core War to a wide readership, and Cohen presents his findings.
- 1986: The Brain virus appears on IBM PC-compatible floppy disks and travels worldwide on copied software. Also in 1986, the United States expands its computer crime law.
- 1987: A number of viruses are found in this year, among them Jerusalem, which was set to damage files on certain Fridays that fell on the thirteenth, and one that spread over a corporate network as a Christmas greeting. Early antivirus programs also appear.
- 1988: The Morris worm spreads over the internet and overloads thousands of machines. A computer emergency response team is created within weeks.
- 1989: A trojan mailed on floppy disks to conference attendees demands payment to restore files, often cited as an early ransomware case.
This is the decade when the idea of an “infection” moved from labs to offices and homes.
The 1990s: stealth, macros and email
- Early 1990s: Virus writers begin to build programs that hide themselves or change form to avoid scanners, so antivirus makers move beyond looking for fixed patterns. Tools to generate viruses appear, which means many people can produce them with little skill.
- 1992: A virus set to trigger on a date in March gets heavy press coverage, with predictions of widespread data loss that in practice proved much exaggerated.
- 1995: The Concept virus spreads through word-processing documents, demonstrating that data files, not just programs, can carry code.
- 1999: Melissa spreads by email to contacts in a user’s address book and forces some organizations to shut down mail servers temporarily.
By the end of the decade, web browsers and email had made the internet the usual route of infection.
The 2000s: worms and crime
- 2000: ILOVEYOU, an email worm disguised as a love letter, spreads around the world in a matter of days.
- 2001: Code Red infects web servers without any user action.
- 2003: Slammer, a very small program, reportedly reaches most vulnerable servers within about ten minutes and slows large parts of the internet.
- Mid-2000s onward: The motive shifts toward profit, with networks of hijacked computers used to send spam and steal banking details.
The 2010s and later
In 2010 researchers described Stuxnet, a worm widely reported to have been aimed at industrial equipment in Iran, which showed that malware could be a tool of state operations. Ransomware, which encrypts files and demands payment, became a major criminal business, and attacks moved to phones, cloud services and connected devices.
What the timeline shows
Two patterns stand out. First, the speed of spread follows the speed of the carrier: months by floppy disk, days by email, minutes by direct network connection. Second, each era’s defense came after its first big outbreak. For the stories behind the individual entries, see the articles on Creeper, Elk Cloner, Brain and the Morris worm in this series.