# History of computer virus **URL:** \ **Category:** Miscellaneous and Personal Stuff I Must Share\ **Created:** [January 26, 2012, 8:08am UTC](https://boards.straightdope.com/t/history-of-computer-virus/610692 "2012-01-26T08:08:07Z")\ **Posts on this page:** 20\ **Page:** 2
**Author:** ![Exapno\_Mapcase](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/exapno_mapcase/32/1051_2.png) [@Exapno\_Mapcase](https://boards.straightdope.com/u/Exapno_Mapcase)\ **Post date:** [January 26, 2012, 6:09pm UTC](https://boards.straightdope.com/t/history-of-computer-virus/610692/21 "2012-01-26T18:09:07Z")
Time Magazine, Sep. 26, 1988, pp.62-67 > [@](#): > > In 1983 the programmers’ code of honor was broken. The culprit was Ken Thompson, the gifted software engineer who wrote the original version of Unix, the computer operating system now coming into widespread use. Thompson was being presented the Association for Computing Machinery’s prestigious A.M. Turing Award when he gave a speech that not only revealed the existence of the first computer viruses but showed the audience how to make them. “If you have never done this,” he told them, “I urge you to try it on your own.” The article does mention that the concept had a long history. > [@](#): > > The idea of an electronic virus was born in the earliest days of the computer era. In fact, it was Computer Pioneer John von Neumann who laid out the basic blueprint in a 1949 paper titled “Theory and Organization of Complicated Automata.” If most of his colleagues found the idea that computer programs might multiply too fantastic to be taken seriously, they can be forgiven, for the paper predated the first commercial electronic computers by several years. But a handful of scientists quietly pursued Von Neumann’s ideas, keeping them alive in the scientific literature until they sprang to life ten years later at AT&T’s Bell Laboratories, in the form of a bizarre after-hours recreation known as Core War. Wikipedia has some relevant dates in the [computer virus article](http://en.wikipedia.org/wiki/Computer_virus) > [@](#): > > The actual term “virus” was first used to denote a self-reproducing program in a short story by David Gerrold in Galaxy magazine in 1969 - and later in his 1972 novel, When HARLIE Was One. In that novel, a sentient computer named HARLIE writes viral software to retrieve damaging personal information from other computers to blackmail the man who wants to turn him off. > > In 1984 Fred Cohen from the University of Southern California wrote his paper “Computer Viruses - Theory and Experiments”.[7] It was the first paper to explicitly call a self-reproducing program a “virus”, a term introduced by Cohen’s mentor Leonard Adleman. > > The Creeper virus was first detected on ARPANET, the forerunner of the Internet, in the early 1970s.[9] Creeper was an experimental self-replicating program written by Bob Thomas at BBN Technologies in 1971.[10] Creeper used the ARPANET to infect DEC PDP-10 computers running the TENEX operating system.[11] Creeper gained access via the ARPANET and copied itself to the remote system where the message, “I’m the creeper, catch me if you can!” was displayed. The Reaper program was created to delete Creeper.[12] > > A program called “Elk Cloner” was the first personal computer virus to appear “in the wild”—that is, outside the single computer or lab where it was created.[13] Written in 1981 by Richard Skrenta, it attached itself to the Apple DOS 3.3 operating system and spread via floppy disk.[13][14] This virus, created as a practical joke when Skrenta was still in high school, was injected in a game on a floppy disk. Ken Thompson was not the first by any definition. None of this really matters. An article about Ken Thompson might be interesting. Talented writers produce non-fiction like this every day. If they want an article published, they contact an editor at a magazine and send in a one-page proposal detailing why the article would be interesting and why they should be the one to write it. If they want a book published, same thing, only with a longer summary, a chapter, and breakdown of the rest of the book. They would certainly do lots of preliminary research and contact the important people first to make sure they’ll still alive, that their memories correspond to what the piece wants to say, and that they’re willing to cooperate. Or you could just write it and throw it up on your website or blog. Nobody would read it, though. That’s the problem. Professional takes work, which is why books and magazines continue to be printed; they’re guaranteed that more effort has been put in and the result is more worth the time to read. Otherwise they could just Google “first computer virus” and read the 200,000 hits that already come up. ---
**Author:** ![sbright33](https://avatars.discourse-cdn.com/v4/letter/s/8e8cbc/32.png) [@sbright33](https://boards.straightdope.com/u/sbright33)\ **Post date:** [January 26, 2012, 6:25pm UTC](https://boards.straightdope.com/t/history-of-computer-virus/610692/22 "2012-01-26T18:25:44Z")
Thank you! I would like to continue this conversation, but only with you and others who answer my original questions. Anyone else please bugger off. ---
**Author:** ![Marley23](https://avatars.discourse-cdn.com/v4/letter/m/45deac/32.png) [@Marley23](https://boards.straightdope.com/u/Marley23)\ **Post date:** [January 26, 2012, 6:26pm UTC](https://boards.straightdope.com/t/history-of-computer-virus/610692/23 "2012-01-26T18:26:53Z")
> [@sbright33](#): > > Anyone else please bugger off. Please don’t order people out of the thread. You’re not their boss. Just respond to who you want to respond to and perhaps try to _politely_ steer the thread in the direction you would prefer. ---
**Author:** ![sbright33](https://avatars.discourse-cdn.com/v4/letter/s/8e8cbc/32.png) [@sbright33](https://boards.straightdope.com/u/sbright33)\ **Post date:** [January 26, 2012, 6:28pm UTC](https://boards.straightdope.com/t/history-of-computer-virus/610692/24 "2012-01-26T18:28:34Z")
> [@](#): > > What PC viruses did something besides display or store text before 1986? Please be specific. I would love to be proved wrong before I finish writing, instead of after. Sorry. ---
**Author:** ![Skywatcher](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/skywatcher/32/254_2.png) [@Skywatcher](https://boards.straightdope.com/u/Skywatcher)\ **Post date:** [January 26, 2012, 7:09pm UTC](https://boards.straightdope.com/t/history-of-computer-virus/610692/25 "2012-01-26T19:09:34Z")
> [@Exapno\_Mapcase](#): > > Wikipedia has some relevant dates in the [computer virus article](http://en.wikipedia.org/wiki/Computer_virus) Wikipedia has [a timeline](http://en.wikipedia.org/wiki/Timeline_of_computer_viruses_and_worms), too. ---
**Author:** ![sbright33](https://avatars.discourse-cdn.com/v4/letter/s/8e8cbc/32.png) [@sbright33](https://boards.straightdope.com/u/sbright33)\ **Post date:** [January 26, 2012, 7:31pm UTC](https://boards.straightdope.com/t/history-of-computer-virus/610692/26 "2012-01-26T19:31:14Z")
I have looked at each of the viruses on Wiki, and technical forensic virus sites, created before 1986. I read paragraphs about each. I am familiar with modern virus architecture. In the early 90’s I read 3 complete books on the topic. None of them before 1985-6 seem to do anything to effect DOS on a PC, other than writing or displaying text. None of them are memory resident. This makes them quite different from a modern virus. I think this is significant on a PC. Please correct me if I’m wrong with a link. Maybe a new one was documented since then. I re-read a few PC virus descriptions yesterday before 1986, all of them familiar from decades ago. I’d like to be proven wrong if it is the truth! ---
**Author:** ![sbright33](https://avatars.discourse-cdn.com/v4/letter/s/8e8cbc/32.png) [@sbright33](https://boards.straightdope.com/u/sbright33)\ **Post date:** [January 26, 2012, 7:49pm UTC](https://boards.straightdope.com/t/history-of-computer-virus/610692/27 "2012-01-26T19:49:21Z")
A virus that is not memory resident cannot write to a disk to reproduce itself if there is only 1 drive in the system. It executes from that disk when it is booted or run and there is nowhere for it to go from there, unless there is a hard drive attached to the system. The first viruses did not support hard drives on a PC. Many of my friends did not have hard drives in 1985. Even with 2 floppies usually only one of them was bootable at any given time. Being memory resident and writing to hard drives was critical to its survival in the wild. The cookie monster virus did not have this ability, but it continued because people thought it was cute! So you can see that being memory resident is a major innovation mentioned in a university paper written after our development was begun. It was difficult to achieve this without crippling DOS, due to the limited amount of memory available. The entire code fit into 1 sector on a disk. Not one cluster but 1 sector. If you don’t care or recognize this than maybe you don’t understand? ---
**Author:** ![sco3tt](https://avatars.discourse-cdn.com/v4/letter/s/45deac/32.png) [@sco3tt](https://boards.straightdope.com/u/sco3tt)\ **Post date:** [January 26, 2012, 8:06pm UTC](https://boards.straightdope.com/t/history-of-computer-virus/610692/28 "2012-01-26T20:06:43Z")
> [@sbright33](#): > > So you can see that being memory resident is a major innovation mentioned in a university paper written after our development was begun. It was difficult to achieve this without crippling DOS, due to the limited amount of memory available. Sorry to burst your bubble, but [TSR](http://en.wikipedia.org/wiki/Terminate_and_Stay_Resident) programs have been around since the early days of DOS, so this doesn’t seem particularly novel either. ---
**Author:** ![sbright33](https://avatars.discourse-cdn.com/v4/letter/s/8e8cbc/32.png) [@sbright33](https://boards.straightdope.com/u/sbright33)\ **Post date:** [January 26, 2012, 8:20pm UTC](https://boards.straightdope.com/t/history-of-computer-virus/610692/29 "2012-01-26T20:20:01Z")
The concept was invented before the PC, but the term was created for the PC. That is exactly what we’re talking about! There was no TSR virus before 1986. That is simply what I’m saying. There is a virus that is first to remain in memory. Nobody is debating this online. A commercial TSR executable is huge in comparison. To do this “properly” required 16k+ of code on a PC for it to be stable. We used less than 200 bytes. Can you spot the difference? ---
**Author:** ![njtt](https://avatars.discourse-cdn.com/v4/letter/n/ecd19e/32.png) [@njtt](https://boards.straightdope.com/u/njtt)\ **Post date:** [January 26, 2012, 8:23pm UTC](https://boards.straightdope.com/t/history-of-computer-virus/610692/30 "2012-01-26T20:23:37Z")
> [@sbright33](#): > > A virus that is not memory resident cannot write to a disk to reproduce itself if there is only 1 drive in the system. It executes from that disk when it is booted or run and there is nowhere for it to go from there, unless there is a hard drive attached to the system. The first viruses did not support hard drives on a PC. Many of my friends did not have hard drives in 1985. Even with 2 floppies usually only one of them was bootable at any given time. Being memory resident and writing to hard drives was critical to its survival in the wild. The cookie monster virus did not have this ability, but it continued because people thought it was cute! > > So you can see that being memory resident is a major innovation mentioned in a university paper written after our development was begun. It was difficult to achieve this without crippling DOS, due to the limited amount of memory available. The entire code fit into 1 sector on a disk. Not one cluster but 1 sector. If you don’t care or recognize this than maybe you don’t understand? The [Elk Cloner virus](http://en.wikipedia.org/wiki/Elk_Cloner) was written in 1982 by Rich Skrenta (15 at the time), and was [still in the wild about ten years later](http://www.ctv.ca/CTVNews/SciTech/20070831/virus_prank_070831/). It was a boot sector virus, spread by infected floppies. It would stay memory resident and infect subsequent floppies put in the machine. In the days before hard drives were common, people would swap floppies around a lot, so this was pretty effective. So no, if your friend is not Rich Skrenta he was not the first with either memory resident or a single disc sector virus, or with one that got into the wild and remained active. Elk Cloner affected Apple IIs. According to the second article I linked above, the first virus that affected DOS computers and that got into the wild was written by two brothers in Pakistan. ---
**Author:** ![sbright33](https://avatars.discourse-cdn.com/v4/letter/s/8e8cbc/32.png) [@sbright33](https://boards.straightdope.com/u/sbright33)\ **Post date:** [January 26, 2012, 8:42pm UTC](https://boards.straightdope.com/t/history-of-computer-virus/610692/31 "2012-01-26T20:42:13Z")
Sorry for the misunderstanding. Please try again. I should have specified IBM PC. It is actually much easier to do what he did with an Apple. I did something similar by creating a boot menu that resides in the boot sector. It would copy itself to other disks with the press of a key. Many people thought of this simultaneously without knowledge of the others existence. The Elk Cloner virus only copies itself and displays text. Nothing more. At least mine had a menu! There was even an option to hide it when booting. The Pakistan virus only writes text. It doesn’t do anything else. The Brain was not memory resident and does not write to hard drives. ---
**Author:** ![johnpost](https://avatars.discourse-cdn.com/v4/letter/j/f17d59/32.png) [@johnpost](https://boards.straightdope.com/u/johnpost)\ **Post date:** [January 26, 2012, 8:43pm UTC](https://boards.straightdope.com/t/history-of-computer-virus/610692/32 "2012-01-26T20:43:28Z")
> [@sbright33](#): > > One interesting chapter is how it was developed simultaneously along with a professor’s thesis paper, without any knowledge in either direction. Both were at the same University with all the work being done across the street. We did not attend his class. There is much in common between the two. Nobody else wrote a similar paper that year. Everybody assumed in the newspaper that there was a connection of course. We did not find out about this until it was finished and released. again who is the professor, what is the title and year of the thesis? what newspaper, date, page for the mistaken article? ---
**Author:** ![TriPolar](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/tripolar/32/3008_2.png) [@TriPolar](https://boards.straightdope.com/u/TriPolar)\ **Post date:** [January 26, 2012, 8:50pm UTC](https://boards.straightdope.com/t/history-of-computer-virus/610692/33 "2012-01-26T20:50:17Z")
> [@sbright33](#): > > A virus that is not memory resident cannot write to a disk to reproduce itself if there is only 1 drive in the system. It executes from that disk when it is booted or run and there is nowhere for it to go from there, unless there is a hard drive attached to the system. The first viruses did not support hard drives on a PC. Many of my friends did not have hard drives in 1985. Even with 2 floppies usually only one of them was bootable at any given time. Being memory resident and writing to hard drives was critical to its survival in the wild. The cookie monster virus did not have this ability, but it continued because people thought it was cute! > > So you can see that being memory resident is a major innovation mentioned in a university paper written after our development was begun. It was difficult to achieve this without crippling DOS, due to the limited amount of memory available. The entire code fit into 1 sector on a disk. Not one cluster but 1 sector. If you don’t care or recognize this than maybe you don’t understand? > [@sbright33](#): > > The concept was invented before the PC, but the term was created for the PC. That is exactly what we’re talking about! There was no TSR virus before 1986. That is simply what I’m saying. > > There is a virus that is first to remain in memory. Nobody is debating this online. A commercial TSR executable is huge in comparison. To do this “properly” required 16k+ of code on a PC for it to be stable. We used less than 200 bytes. Can you spot the difference? You clearly don’t understand this subject. All code executes from memory, not disk. TSR is a term invented for DOS because it didn’t originally have this capability, necessary for any useful modern OS. And of course modifying the boot sector is nothing special anyway, that’s how you change an OS on a simplistic machine. Your friend may have created a computer virus, but this had been done frequently before 1986 in all sorts of computers. Releasing a PC virus ‘into the wild’ before that had no meaning because there was so little interconnectivity, but there was malware that had made it’s way into distribution disks and were appearing in bulletin board download. You may have a perfectly good story to tell, but your claim of being the first to do something significant has as much meaning as the #1 hit claim applied to all network primetime shows. ---
**Author:** ![Cazzle](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/cazzle/32/75_2.png) [@Cazzle](https://boards.straightdope.com/u/Cazzle)\ **Post date:** [January 26, 2012, 8:56pm UTC](https://boards.straightdope.com/t/history-of-computer-virus/610692/34 "2012-01-26T20:56:48Z")
So your friend wrote the first IBM PC virus that was memory resident and did more than display text, but not the first virus, or the first IBM PC virus, or the first memory resident virus, or the first virus to do more than display text. If it’s a good story it might be interesting to some but if you have to keep redefining “first” to exclude others, at some point you’ll have defined a catagory so narrow that it will inspire limited interest. ---
**Author:** ![Jophiel](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/jophiel/32/66_2.png) [@Jophiel](https://boards.straightdope.com/u/Jophiel)\ **Post date:** [January 26, 2012, 9:00pm UTC](https://boards.straightdope.com/t/history-of-computer-virus/610692/35 "2012-01-26T21:00:09Z")
> [@sbright33](#): > > Sorry for the misunderstanding. Please try again. I should have specified IBM PC. As an outsider without a dog in this fight, I have to say that the more you need to narrow down what “first virus” means, the less interesting it becomes. “It was the first virus. Well, the first that did anything. Anything in the wild, I mean. With resident memory. No, I meant on _IBM PC_ resident memory…” Edit: Cazzle made my point as I was typing this. ---
**Author:** ![sco3tt](https://avatars.discourse-cdn.com/v4/letter/s/45deac/32.png) [@sco3tt](https://boards.straightdope.com/u/sco3tt)\ **Post date:** [January 26, 2012, 9:06pm UTC](https://boards.straightdope.com/t/history-of-computer-virus/610692/36 "2012-01-26T21:06:07Z")
> [@sbright33](#): > > A commercial TSR executable is huge in comparison. To do this “properly” required 16k+ of code on a PC for it to be stable. We used less than 200 bytes. Can you spot the difference? TSRs never needed to be 16k commercial executables. You can call INT 21H from a small com program just as readily. The print spooler that shipped with every copy of MS-DOS was just such a program, as I recall. Here’s [some code for a TSR](http://groups.google.com/group/net.micro.pc/browse_frm/thread/bc364506af962208/77d26c5cce247c51?lnk=st&q=int+27h&rnum=1#77d26c5cce247c51) that’s even smaller and predates your claim by three years. This example does not require 16k. What about it do you consider “improper” or unstable? ---
**Author:** ![sbright33](https://avatars.discourse-cdn.com/v4/letter/s/8e8cbc/32.png) [@sbright33](https://boards.straightdope.com/u/sbright33)\ **Post date:** [January 26, 2012, 9:12pm UTC](https://boards.straightdope.com/t/history-of-computer-virus/610692/37 "2012-01-26T21:12:25Z")
You clearly don’t understand what I said. The S in TSR stands for Stay. I wrote one of the first commercial TSR’s in 1985. The first memory resident virus resided in EXE files, not only the boot sector which was also tried. There is a difference between executing in memory like all program do, and residing in memory, Staying, like the first virus to do so. I’m guessing you weren’t even born in 1986 😉 We had a LAN that was used by every student in 1985. 4000 usernames. We had a variant that replicated this way as well, before any other existed. But much more success leaving the campus via floppies, of course. ---
**Author:** ![sbright33](https://avatars.discourse-cdn.com/v4/letter/s/8e8cbc/32.png) [@sbright33](https://boards.straightdope.com/u/sbright33)\ **Post date:** [January 26, 2012, 9:15pm UTC](https://boards.straightdope.com/t/history-of-computer-virus/610692/38 "2012-01-26T21:15:04Z")
You’re right, this is getting way too complex. What is the first PC virus to ACTUALLY DO SOMETHING? That’s 4 words. ---
**Author:** ![Bytegeist](https://avatars.discourse-cdn.com/v4/letter/b/9dc877/32.png) [@Bytegeist](https://boards.straightdope.com/u/Bytegeist)\ **Post date:** [January 26, 2012, 9:26pm UTC](https://boards.straightdope.com/t/history-of-computer-virus/610692/39 "2012-01-26T21:26:11Z")
> [@sbright33](#): > > I should have specified IBM PC. It is actually much easier to do what he did with an Apple. What makes you say that? ---
**Author:** ![Marley23](https://avatars.discourse-cdn.com/v4/letter/m/45deac/32.png) [@Marley23](https://boards.straightdope.com/u/Marley23)\ **Post date:** [January 26, 2012, 9:26pm UTC](https://boards.straightdope.com/t/history-of-computer-virus/610692/40 "2012-01-26T21:26:31Z")
> [@sbright33](#): > > What is the first PC virus to ACTUALLY DO SOMETHING? Define “do something.” > [@](#): > > That’s 4 words. Define “4.” [Previous page](https://boards.straightdope.com/t/history-of-computer-virus/610692.md?page=1) [Next page](https://boards.straightdope.com/t/history-of-computer-virus/610692.md?page=3)