- Timeline of notable computer viruses and worms
This is a
timelineof noteworthy computer viruses and worms.
* Creeper virus was detected on
ARPANETinfecting the Tenex operating system. Creeper gained access independently through a modem and copied itself to the remote system where the message, 'I'M THE CREEPER : CATCH ME IF YOU CAN.' was displayed. The Reaper program, itself being a virus, was created to delete Creeper. The creators of both programs are unknown.
Rabbit virusappears infecting other machines via multiplication. Named for the speed at which it clogged the system with copies of itself, reducing system performance, before reaching a threshold and crashing.
* ANIMAL was a popular game written for the
UNIVAC 1108which asked a number of questions to the user in an attempt to guess the type of animal that the user was thinking of. When run, the related program PERVADE would also create a copy of itself and ANIMAL in every directory to which the current user had access. It spread across the multi-user UNIVACs when users with overlapping permissions discovered the game, and to other computers when tapes were shared. The program was carefully written to avoid damage to existing file or directory structure, and to not copy itself if permissions did not exist or if damage could result. Its spread was therefore halted by an OS upgrade which changed the format of the file status tables that PERVADE used for safe copying. Though non-malicious (and fairly entertaining) in nature, "Pervading Animal" represents the first Trojan "in the wild". [http://www.fourmilab.ch/documents/univac/animal.html The Animal Episode ] ]
* Jürgen Kraus wrote master thesis Selbstreproduktion bei Programmen (Self-reproduction of programs).
* A program called Elk Cloner, written for Apple II systems and created by
Richard Skrenta. Apple II was seen as particularly vulnerable due to the storage of its operating system on floppy disk. Elk Cloner's design combined with public ignorance about what malwarewas and how to protect against it led to Elk Cloner being responsible for the first large-scale computer virus outbreak in history.
* The term 'virus' is coined by Frederick Cohen in describing self-replicating computer programs. In 1984 Cohen uses the phrase "computer virus" – as suggested by his teacher
Leonard Adleman– to describe the operation of such programs in terms of "infection". He defines a 'virus' as "a program that can 'infect' other programs by modifying them to include a possibly evolved copy of itself."
November 10, 1983, at Lehigh University, Cohen demonstrates a virus-like program on a VAX11/750 system. The program was able to install itself to, or infect, other system objects.
* January: The Brain
boot sectorvirus (aka Pakistani flu) is released. Brain is considered the first IBM PC compatiblevirus, and the program responsible for the first IBM PC compatible virus epidemic. The virus is also known as Lahore, Pakistani, Pakistani Brain, as it was created in Lahore, Pakistan by 19 year old Pakistani programmer, Basit Farooq Alvi, and his brother, Amjad Farooq Alvi.
* December 1986: Ralf Burger presented the Virdem model of programs at a meeting of the underground
Chaos Computer Clubin Germany. The Virdem model represented the first programs that could replicate themselves via addition of their code to executable DOS files in COM format.
* Appearance of the Vienna virus, which was subsequently neutralized--the first time this had happened on the IBM platform. [ [http://www.viruslist.com/en/viruses/encyclopedia?chapter=153311150 Kaspersky Lab viruslist] ]
* Appearance of Lehigh virus, boot sector viruses such as Yale from USA, Stoned from New Zealand, Ping Pong from Italy, and appearance of first self-encrypting file virus, Cascade. Lehigh was stopped on campus before it spread to the wild, and has never been found elsewhere as a result. A subsequent infection of Cascade in the offices of IBM Belgium led to IBM responding with its own antivirus product development. Prior to this, antivirus solutions developed at IBM were intended for staff use only.
* October: The Jerusalem virus, part of the (at that time unknown) Suriv family, is detected in the city of
Jerusalem. Jerusalem destroys all executable files on infected machines upon every occurrence of Friday the 13th (except Friday 13 November 1987 making its first trigger date May 13 1988). Jerusalem caused a worldwide epidemic in 1988.
* November: The SCA virus, a boot sector virus for
Amigas appears, immediately creating a pandemic virus-writer storm. A short time later, SCA releases another, considerably more destructive virus, the Byte Bandit.
Christmas Tree EXECwas the first widely disruptive replicating network program, which paralysed several international computer networks in December 1987.
* June: The
Festering Hate Apple ProDOSvirus spreads from underground pirate BBS systems and starts infecting mainstream networks.
November 2: The Morris worm, created by Robert Tappan Morris, infects DEC VAXand Sun machines running BSD UNIXconnected to the Internet, and becomes the first worm to spread extensively "in the wild", and one of the first well-known programs exploiting buffer overrunvulnerabilities.
October 1989: Ghostball, the first multipartite virus, is discovered by Friðrik Skúlason
* Mark Washburn working on an analysis of the Vienna and Cascade viruses with Ralf Burger develops the first family of polymorphic virus: the Chameleon family. Chameleon series debuted with the release of 1260.
* Michelangelo was expected to create a digital apocalypse on March 6, with millions of computers having their information wiped according to mass media hysteria surrounding the virus. Later assessments of the damage showed the aftermath to be minimal.
* The "Concept virus" the first Macro virus is created This virus did a lot of damage.
* "Ply" - DOS 16-bit based complicated polymorphic virus appeared with built-in permutation engine.
June 2: The first version of the CIH virus appears.
March 26: The Melissa worm is released, targeting Microsoft Word and Outlook-based systems, and creating considerable network traffic.
June 6: The ExploreZipworm, which destroys Microsoft Officedocuments, is first detected.
Happy1999worm invisibly attached itself to emails. Displayed fireworks to hide changes being made and wished you a happy new year. Modified system files related to Outlook Expressand Internet Exploreron Windows 95and Windows 98.
2000 and later
* May: The
VBS/Loveletter('ILOVEYOU') worm appeared. As of 2004this is the most costly virus to businesses, causing upwards of 5.5 to 10 billion dollars in damage. The backdoor trojan to the worm, Barok, was created by Filipino programmer Onel de Guzman; it is not known who created the attack vector or who (inadvertently) unleashed it; de Guzman himself denies being behind the outbreak although he suggests he may have been duped by someone using his own Barok code as a payload.
* Zmist - a fully metamorphic, code integrating virus.
* March: Simile - a multi-OS, metamorphic virus written in
May 8: The Sadmind wormspreads by exploiting holes in both Sun Solaris and MicrosoftIIS.
* July: The
Sircamworm is released, spreading through e-mails and unprotected network shares.
July 13: The Code Red wormattacking the Index Server ISAPI Extension in Microsoft Internet Information Servicesis released.
August 4: A complete re-write of the Code Red worm, Code Red IIbegins aggressively spreading, primarily in China.
September 18: The Nimdaworm is discovered and spreads through a variety of means including vulnerabilities in Microsoft Windows and backdoors left by Code Red IIand Sadmind worm.
October 26: The Klezworm is first identified.
January 24: The SQL slammer worm, also known as the Sapphire worm, attacks vulnerabilities in Microsoft SQL Serverand MSDEcauses widespread problems on the Internet.
August 12: The Blaster worm, also known as the "Lovesan" worm, spreads rapidly by exploiting a vulnerability in system services present on Microsoft Windowscomputers.
August 18: The Welchia(Nachi) worm is discovered. The worm tries to remove the blaster worm and patch Windows.
August 19: The Sobig worm(technically the Sobig.F worm) spreads rapidly via mail and network shares.
October 24: The Sober wormis first seen and maintains its presence until 2005 with many new variants.The simultaneous attacks on network weakpoints by the Blaster and Sobig worms caused a massive amount of damage .
* Late January:
MyDoomemerges, and currently holds the record for the fastest-spreading mass mailer worm.
March 19: The Witty wormis a record-breaking worm in many regards. It exploited holes in several Internet Security Systems(ISS) products. It was the fastest disclosure to worm, it was the first internet worm to carry a destructive payload and it spread rapidly using a pre-populated list of ground-zero hosts.
May 1: The Sasser wormemerges by exploiting a vulnerability in LSASS and causes problems in networks, even interrupting business in some cases.
Santy, the first known "webworm" is launched. It exploited a vulnerability in phpBBand used
August 16: The Zotob worm and several variations of malwareare discovered. The effect was overblown because several United Statesmedia outlets were infected.
October 13: The Samy XSS worm became the fastest spreading virus by some definitions as of 2006.
October 31: Sony BMGwas found to have purposefully infected music CDs with a rootkit in an attempt to prevent illegal copying of music.
* Late September:
Strationor Warezov worm first discovered.
January 20: The Nyxemworm was discovered. It spread by mass-mailing. Its payload, which activates on the third of every month, starting on February 3, attempts to disable security-related and file sharing software, and destroy files of certain types, such as Microsoft Officefiles.
February 16: discovery of the first-ever malware for Mac OS X, a low-threat trojan-horse known as OSX/Leap-A or OSX/Oompa-A, is announced.
January 17: Storm Wormidentified as a fast spreading email spamming threat. It begins gathering infected computers into the Storm botnet. By around June 30th it had infected 1.7 million computers, comprised between 1 and 10 million computers by September. [cite web |title=World's most powerful supercomputer goes online |url=http://seclists.org/fulldisclosure/2007/Aug/0520.html |date=31 August 2007 |accessdate=2007-11-04 |publisher= Full Disclosure|author=Peter Gutmann ] Thought to have originated from Russia, it disguises itself as a news email containing a film about bogus news stories asking you to download the attachment which it claims is a film.
May 6: Rustock.C, a hitherto-rumoured spambot-type malware with extremely advanced rootkit capabilities, was announced to have been analysed and detected, having been in the wild and undetected since October 2007 at the very least. [http://www.pr.com/press-release/84130]
Jun 29: An XSS Wormknown as JTV.worm was initiated by a security group known as TheDefaced affecting Justin.tv, infecting 2,525 profiles within 24 hours. The worm was used for research purposes and the security team released detailed information never-before researched about the factors that affect XSS worms.
List of computer viruses
List of trojan horses
Wikimedia Foundation. 2010.