A virus with a return address
In 1986, floppy disks began to circulate on which the boot area held an unusual text message. It said, in English, that the computer was infected with the “Brain” virus and gave a business name, a street address in Lahore, Pakistan, and several telephone numbers. It also warned people that they should contact the authors for a vaccine. Few computer viruses before or since have been so open about their origin.
The program is generally attributed to two brothers, Basit Farooq Alvi and Amjad Farooq Alvi, who ran a small computer business in Lahore. It is often called the first virus for IBM PC and compatible computers. As with other early claims, the qualifier is important: Elk Cloner on the Apple II and various laboratory experiments came earlier, but Brain was among the first to spread internationally on the PC platform.
What it did
Brain was a boot-sector virus. When a PC starts, it reads a small program from the first sector of the disk and runs it. Brain replaced this sector on an infected 360-kilobyte floppy with its own code, moving the original sector elsewhere on the disk. On starting from such a disk, the virus loaded itself into memory and watched for disk access. When the user inserted another floppy of the right type, it copied itself there too.
Reports from the time describe visible effects: the disk label was changed to “(c) Brain,” floppy drives became slower, and some systems showed less free memory than expected. The accounts do not generally describe deliberate destruction of data. Some users did experience problems, however, usually because the virus marked a few disk areas as bad or because of conflicts with other software.
Why the brothers say they wrote it
According to the brothers, as reported in interviews over the years, their business sold software they had written, including a program for monitoring heart patients, and they found that customers and visitors were buying cheap copies of PC software in Pakistan, where copying was common and legally unprotected. They have described Brain as a way of discouraging illegal copying of their own software, or at least of tracking it, and said it was designed to be mild. That is why their name and contact information were in the message.
Their account does not fully settle the question of intent, and not everyone has accepted every part of the story. What is well documented is that the program was tied to copied software and that its authors were easy to identify.
How it spread
The virus did not remain local. Travelers and students bought copies of programs in Pakistan and took them home. Once on a machine in the United States or Europe, Brain spread the same way as any boot-sector virus, through disks lent from one person to another, and through the common habit of keeping a floppy in the drive at startup. In 1986 there was no routine scanning, and few users knew that a boot disk could carry code. Reports of infections came from universities and newspapers in the United States and elsewhere, and the brothers said they received angry phone calls from around the world. Their phones, they said, kept ringing.
This pattern, a virus carried by physical media across borders, shows how global the software trade already was, even though most of these PCs were never connected to the early computer networks that universities used.
Early piracy and protection
The story sits in a period when copy protection was a major concern. Software companies of the 1980s often tried to stop duplication with special disk formats, hardware keys or deliberate flaws on the master disk. Users disliked these measures, and crackers worked around them. Brain was an unusually aggressive version of the same impulse, a protection scheme that spread to other people’s machines without permission.
Security professionals have criticized the approach, since a program that modifies other people’s disks does so without their consent and may do harm even if intended not to. In the following years, that ethical line became clearer: even well-meant self-spreading code is generally treated as malware. Many later writers, regardless of what they said about their motives, did not provide contact details.
What came after
Brain was the ancestor of a number of variants, written by others who modified the code, some of which were more destructive. It also contributed to the growing sense, around 1987, that viruses were a regular problem rather than a curiosity. Early antivirus tools included detection and removal of Brain and its relatives, and technical analyses of the program circulated among researchers, helping them learn how boot-sector infection worked.
Years later, reporters returned to the same address in Lahore and found the brothers still running a business there, now an internet service provider. They have said that they regretted the trouble caused but had not intended harm. Whether they deserve a place in virus history as pioneers or as an example of what not to do is a matter of judgment, but the documents and the disks themselves remain a clear record of how an early virus moved across the world in a box of copied software.