In November 1988, one program knocked out roughly 10% of the machines connected to the internet. Nobody fired it as a weapon. A student wrote it as an experiment, a bug slipped through, and the network paid for it. That is the day malware went from curiosity to infrastructure problem, and it is also the day the word everyone reached for turned out to be the wrong one. The Morris worm was a worm. The distinction is not a technicality, it is what decides how a threat gets in and how you fight it.
Two months before that, none of this was on anyone’s radar. That is the trap with computer viruses. We use the word for everything, so we prepare for the wrong thing. A virus is one member of a much bigger family, malware, and each member plays by different rules. Learn the family tree and the news stops sounding like random noise.
Here is the deal. You are going to learn what a virus actually is, how it differs from a worm, a trojan and ransomware, how it spreads, where it came from and which ones did the most damage in history. The part worth more than the history: what to do so none of it lands on your machine.
What is a computer virus?
A computer virus is a program or piece of code that installs itself without your permission and goes to work changing how the machine behaves. Like its biological namesake, it has two defining habits. It copies itself, and it needs a host to do it.
NIST, the US standards body, puts it precisely. Malware counts as a virus when it spreads by modifying other programs to carry a copy of itself, and when it only runs the moment you run the infected program. That detail is what separates it from a worm. A virus needs something to ride on. A worm needs nothing.
Who invented the word? Leonard M. Adleman, in 1984, borrowing the term from biology. He built it on the experimental work of his student Fred Cohen, who a year earlier at the University of Southern California had shown that a program could copy itself and infect another. The name came after the demonstration, which is the honest order of things. You see the behaviour first, then you find a word for it.
Virus vs worm vs trojan vs ransomware
People lump them together because the damage looks the same from the outside. The mechanism underneath does not. Two questions sort almost any piece of malware you will meet: does it copy itself, and does it need a person to trigger it?
| Type | How it acts | Copies itself |
|---|---|---|
| Virus | Hides inside a file and runs when you open it. Replicates within the machine. | Yes, by infecting a host |
| Worm | Spreads on its own across the network, with nothing to open. | Yes, by itself |
| Trojan | Pretends to be legitimate software and opens a back door for the attacker. | No, it talks you into it |
| Ransomware | Encrypts your files and demands payment to give them back. | Depends on how it arrives |
| Spyware | Watches your activity and collects data, often without you noticing. | Not always |
| Adware | Floods you with adverts, annoying and sometimes a doorway for others. | No |
| Rootkit | Hides deep in the system to go unnoticed. | Not by default |
| Keylogger | Records the keys you press to steal passwords. | No |
Here is where the vocabulary trips people up. Ransomware is an effect you can pick up from several sources. It can arrive inside a virus, a worm or a trojan, and what defines it is what it does once it is inside. Spyware and adware work the same way. They name the payload, and the delivery method is a separate question. That is why the sentence “I caught a virus” almost never describes the thing that happened or the response it needs.
Get this straight and you will understand why “I keep my antivirus updated” is a thin defence. Against ransomware that walked in through an email, the antivirus is often the last to know. The encryption starts, the files lock, and only then does the alarm go off.
Types of computer viruses
Inside the virus family, the usual sorting looks at where the thing hides and how it behaves.
- Boot sector: it loads before the operating system does, so it is awake before your defences are.
- File infector: it attaches to an executable and fires the moment you open that program.
- Macro: it rides inside an office document and triggers when you open the file or click to enable macros. That was Melissa’s road.
- Polymorphic: it rewrites its own code with every copy, so detection by signature falls apart. The antivirus keeps hunting a fingerprint that changes each time it looks.
- Resident and multipartite: it stays in memory and hits several parts of the system at once.
Bootkits push the idea further. They install themselves in firmware or the UEFI boot sector, the first code the machine runs. Cleanup there is a headache, because the threat loads before the antivirus and can hide from the very operating system meant to remove it.
How a virus spreads
A virus does not hop from one computer to the next on its own. It needs a vehicle and, almost always, a human hand on the door. The same routes show up in incident after incident.
- Email attachments and links. The classic. An executable, a macro document, or a link to a site that quietly downloads the payload. Social engineering, with urgency, fear and curiosity doing the heavy lifting, is what opens the door.
- Removable drives. USB sticks and drives carried some of the most memorable outbreaks, Brain and Stuxnet among them, because they reach air-gapped networks no email can touch.
- Downloads and pirated software. Activators, cracks and free programs from dubious sources are a favourite disguise for a trojan.
- Unpatched vulnerabilities. A flaw in an exposed service (SMB, RDP, a content management system) lets an attacker in while the user does nothing at all. WannaCry exploited exactly that.
- Shared networks and remote desktop. An infected machine can scan the local network and jump to shared folders or an open remote session.
Of all those routes, the person is still the decisive one. Most infections begin with someone opening what they should not have opened, or ignoring an update that had been sitting there for weeks.
What was the first computer virus?
The first program that fits the definition was Creeper, in 1971. It moved across ARPANET, copied itself from machine to machine and printed a message: “I’m the creeper, catch me if you can!”. It did no harm. It was an experiment to see whether software could replicate on its own. To stop it, someone wrote another program, Reaper, that hunted it down. The first tool built to remove malware existed before most people had even heard the word malware.
The first virus to reach personal computers was Elk Cloner, in 1982, written by the student Rich Skrenta for the Apple II. It stuck to floppy disks and showed a poem. Four years later, in 1986, Brain showed up, the one most people call the first PC virus. It spread by floppy disk too and, with a certain cheek, carried the names of its own authors.
The first outbreak that shook the internet was a worm, and that is worth noticing. The Morris worm, on 2 November 1988, took down close to 10% of the connected machines and forced the creation of the first incident response teams, the CERT/CC. From that point, malware was no longer a prank. It was a problem for the infrastructure everyone depended on.
The most dangerous viruses in history
Some of these are viruses in the strict sense. Others belong to the same family and earn their place in the line-up because of the damage they did.
ILOVEYOU (2000)
This one was born in the Philippines and it ran on the oldest trick there is. The subject line promised love. The attachment was a file you had to open. That was enough to infect tens of millions of machines and push governments and companies to switch email off entirely. Damage estimates run into the billions of dollars. Its creator, Onel de Guzman, was never convicted, because Philippine law at the time did not cover the offence. The charges were dropped and he walked.
Melissa (1999)
Melissa arrived as a Word document with a lure few people could ignore: a supposed list of passwords for adult websites. Open it and the virus mailed itself to the 50 most important contacts in your address book. Its author, David L. Smith, was arrested within a week. He cooperated with the authorities, and his sentence dropped from 10 years to 20 months. Damage was estimated at $80 million. The name came from a Florida dancer, which tells you how seriously the author took the whole thing.
Zeus (2007 onwards)
A banking trojan built for Windows. It got in through drive-by downloads and phishing, then stripped credentials from social networks, email and, above all, bank accounts. Zeus grew into one of the biggest botnets in history, with more than a million infected machines in the United States alone. Its most damaging variant, GameOver Zeus, was taken down in 2014. The man behind it, Evgeniy Bogachev, is still at large.
Stuxnet (2010)
Forget your laptop for a second. Stuxnet was a weapon of cyber warfare, attributed to the United States and Israel, though never officially confirmed, and built to sabotage Iran’s nuclear programme. It spread through USB drives and quietly altered the speed of industrial equipment until the machinery broke. That made it the first known malware capable of causing physical damage to real facilities, and a hard warning about how far this field reaches.
CryptoLocker (2013)
CryptoLocker is where modern ransomware turns professional. It encrypted your files and demanded around $400 to hand them back, and it infected hundreds of thousands of machines. The network was taken down in 2014, but its operator, the Russian Evgeniy Bogachev, is still at large. The US State Department offers up to $3 million for information leading to him.
WannaCry (2017)
In 2017, WannaCry went global. It encrypted hospitals, companies and public administrations in more than 150 countries, and the United Kingdom was among the hardest hit. All it took was one known vulnerability in the SMBv1 protocol, catalogued as CVE-2017-0144 and patched months earlier, still unapplied on thousands of systems. Essential services went down for days. WannaCry carried worm features so it could leap from machine to machine across a network, which is why it spread faster than a plain virus ever could.
How to protect yourself from a virus
There is no silver bullet. Protection comes from stacked layers. The first layer is discipline, and it costs nothing.
- Update. Most major incidents exploit flaws that already had a patch. WannaCry is the perfect example. The fix was out months before the outbreak.
- Distrust attachments. Especially when the message is urgent, alarming or promises something you cannot resist. That urgency is the design.
- Backups, offline. Against ransomware there is no better defence. If you hold a disconnected copy, the ransom loses almost all its value. The 3-2-1 rule still holds: three copies, on two kinds of media, with one kept off-site.
- A different password for every service and two-factor authentication wherever it is offered. Reusing one password is how a single breach turns into ten.
- Fewer privileges. Use a normal account day to day and an administrator account only when you need it. It is the same idea behind role-based access control.
- Antivirus and EDR as one layer more. They catch what is known and flag odd behaviour, but they do not replace the rest. NIST publishes a dedicated guide to preventing and handling malware incidents.
- Care with unknown USB drives and with any software that promises to activate something paid, for free.
If it still gets in, do not make it worse. Pull the machine off the network, do not pay the ransom, and keep the encrypted files, because they can help you recover the day a key surfaces. Then restore from a clean backup. Microsoft publishes its own guidance on ransomware protection for Windows environments, and it is worth reading before you need it.
Frequently asked questions
What is a computer virus?
A malicious program that installs itself without permission, alters how the machine works and replicates inside it. It is one type of malware among many. Worms, trojans, ransomware and spyware are relatives, but each one behaves differently, and that difference decides how you deal with it.
What was the first computer virus in history?
Creeper, in 1971. It was an experiment that copied itself between machines over ARPANET without causing harm. The first PC virus was Brain, in 1986, and before it came Elk Cloner (1982) on the Apple II. The first outbreak that really hurt the network was the Morris worm, in 1988.
What is the difference between a virus and a trojan?
A virus replicates and needs you to run the file that contains it. A trojan disguises itself as legitimate software and, when you open it, opens a door for the attacker. A trojan does not usually spread on its own. It persuades you to install it, and that is the whole strategy.
How does a computer virus spread?
Through email attachments and links, USB drives, pirated software downloads, unpatched vulnerabilities and shared networks. Almost always it takes someone running something, or a system left unpatched for too long.
What is ransomware?
Malware that encrypts your files and demands a financial ransom to return them. The best defence is not paying. It is having offline backups and keeping your systems updated, so the day the demand arrives you restore your files and walk away.
Do antivirus programs do any good?
Yes, as one layer more, not as the only one. They detect what is known, but new malware and anything arriving through social engineering are fought with updates, backups, fewer privileges and user training. The tool helps. The habits finish the job.
The bottom line
From a harmless experiment on ARPANET to a threat that takes hospitals offline around the world. In fifty years, malware has gone from curiosity to industry to weapon. ENISA still ranks ransomware among the top threats year after year. And the lesson from the big incidents is almost never technical. They work because a person slips up or because a patch was missing, and the attacker usually gets credit he does not deserve. Lock the door and most of these stories never reach you.
If you want to understand the people on the other side, start with what a hacker really is. Then look at how RBAC limits the damage when someone gets in where they should not. And if you want the full origin story of the first worm and the first antivirus, Creeper and Reaper picks it up from 1971.