50 Fun Facts About Computer Viruses

The 2003 Blaster worm hid a message in its code telling which tech billionaire to fix his software?

Bill Gates was the Microsoft co-founder it addressed, and Blaster also set infected PCs to flood the Windows Update website with traffic.

Researchers named the 2001 Code Red worm after a flavour of which soft drink they were drinking?

Mountain Dew Code Red kept two eEye Digital Security researchers going as they dissected the worm, which was built to attack fixed addresses including the White House web server.

A 2001 email worm tricked people into opening it by promising a photo of which Russian tennis star?

Anna Kournikova was the bait, and the 20-year-old Dutchman behind the worm built it in a few hours with a ready-made toolkit, then surrendered to police days later.

Which virus, named after a Renaissance artist, caused a 1992 media scare over PCs being wiped on 6 March?

Michelangelo slept until the artist's birthday each year, and after warnings that millions of PCs carried it, most owners scanned and removed it in time, so the day passed with little damage.

In which film does Jeff Goldblum's character upload a computer virus to an alien mothership?

Independence Day has satellite engineer David Levinson use the virus to drop the invaders' shields, so that a nuclear missile can destroy the mothership.

Onel de Guzman, who released the ILOVEYOU worm in 2000, went free because which country had no hacking law?

Philippines prosecutors dropped every charge against the college dropout, even though the worm did roughly $10 billion of damage; a new e-commerce law was signed in response.

A 2000 email worm, thought to be the first malware aimed at children, featured which Pokémon character?

Pikachu fronted an email that tried to delete key Windows folders, but an accidental prompt asked victims for permission first, which blunted the damage.

The first known ransomware, mailed out in 1989 by biologist Joseph Popp, arrived on which storage medium?

Floppy disks labelled as AIDS information carried the program, which scrambled file names after 90 restarts and demanded $189 sent to a post office box in Panama.

The Jerusalem virus, first detected at an Israeli university in 1987, deleted programs run on which recurring date?

Friday the 13th set it off in every year except 1987, so the first strike came on 13 May 1988; the virus also slowed older PCs to a fifth of their normal speed.

Elk Cloner, an Apple II virus written around 1982 by a 15-year-old as a joke, showed what on every 50th use?

A short poem about the virus filled a blank screen, the work of high-school student Rich Skrenta, whose prank became one of the first viruses to escape onto other people's computers.

Which worm, found in 2010, wrecked Iranian uranium centrifuges by attacking their Siemens industrial controllers?

Stuxnet used four previously unknown Windows flaws to reach its target, and reportedly destroyed almost one-fifth of Iran's nuclear centrifuges by making them tear themselves apart.

Which May 2017 ransomware outbreak hit Britain's National Health Service and was later blamed on North Korea?

WannaCry may have reached 70,000 health-service devices, including MRI scanners and blood-storage fridges, before a researcher halted it within hours by finding a kill switch.

Which antivirus pioneer founded his software company in 1987 and died in a Spanish prison cell in 2021?

John McAfee sold his stake in the company that bears his name in 1994, and decades later was arrested in Spain on US tax evasion charges, dying as his extradition was approved.

CryptoLocker, the 2013 ransomware that locked victims' files, took payment by voucher or in which digital currency?

Bitcoin bought the unlock key until 2014, when police seized the botnet spreading CryptoLocker and a security firm used the captured keys to build a free recovery tool.

The CIH virus, which could erase a PC's BIOS chip, was nicknamed after which disaster whose anniversary set it off?

Chernobyl became the media's name for it because the trigger date was 26 April, although the Taiwanese student who wrote it had simply signed the code with his initials.

Brain, the first virus for the IBM PC, was written in 1986 by two brothers in which country?

Pakistan's Alvi brothers said they wrote it to stop piracy of their medical software, and they put their own address and phone numbers in the code so victims could call for a cure.

Which 1971 program, written at BBN to hop between ARPANET mainframes, is widely accepted as the first computer worm?

Creeper did no harm beyond printing a taunt on the teletype, and it could never have reached more than 28 machines, the number on the network running the right operating system.

The Samy worm of 2005 infected over a million user profiles within 20 hours on which social network?

MySpace was overrun because every profile that viewed an infected page sent creator Samy Kamkar a friend request and then passed the code on to its own visitors.

A self-mailing program that clogged IBM's worldwide network in December 1987 drew which festive picture on screen?

A Christmas tree made of text characters appeared while the program, written by a university student, quietly sent itself to every entry in the victim's email contacts file.

Which Hungarian-born mathematician's 1949 lectures on self-reproducing automata laid the theory behind computer viruses?

John von Neumann described how a program could be designed to reproduce itself decades before anyone released one, which is why he is called the theoretical father of computer virology.

Which ability, shared by viruses and worms, is what a Trojan horse program generally lacks?

Self-propagation is beyond a Trojan, which, like the wooden horse of Greek myth, depends on tricking a person into letting it in.

A hijacked computer that sends spam or attacks websites without its owner knowing is given which undead nickname?

Zombie machines are herded together into botnets and steered remotely, and most of their owners never realise the computer is taking orders from someone else.

Traditional antivirus scanners identify known malware by checking files against a database of what?

Signatures are extracted from each captured sample and added to the scanner's database, which is why virus writers began making code that disguises itself differently every time.

Melissa, the fast-spreading email virus of 1999, belonged to which class of virus that hides in office documents?

Macro viruses are written in the scripting language built into applications such as Microsoft Word, so simply opening an infected document is enough to set one off.

Which area of a drive did 1980s viruses such as Brain and Stoned infect?

Boot sector code is loaded and run before the operating system, which let a virus hiding there take control of the machine ahead of everything else.

What term describes a virus that mutates its code with each infection so scanners cannot match a fixed pattern?

Polymorphic code scrambles itself differently in every copy while doing exactly the same job, which forces antivirus tools to hunt for deeper patterns or run it in a safe emulator.

What name is given to malicious code that lies hidden in a system until a chosen date or condition sets it off?

Logic bomb is the term, and the textbook case is a programmer who hides code that will start deleting files if he is ever dismissed from the company.

Borrowed from transport, which term names the part of a virus or worm that carries out the malicious action?

Payload originally meant the share of a load that pays for the trip; in malware it can be anything from a prank message on screen to wiping the whole drive.

Which 1972 program by Ray Tomlinson, built to chase and delete an ARPANET worm, is called the first antivirus software?

Reaper moved across the network deleting the worm wherever it found it, and the duel between the two programs later inspired the programming game Core War.

Which 2003 worm, only 376 bytes long, infected most of its 75,000 victims within ten minutes?

Slammer, in full SQL Slammer, fitted inside a single network packet, and the flood of copies it sprayed out crashed routers around the world and dramatically slowed internet traffic.

Which 2004 worm, written by a German teenager, forced Delta Air Lines to cancel several transatlantic flights?

Sasser's author, 18-year-old Sven Jaschan, was caught after one of his friends tipped off Microsoft, which had offered a $250,000 bounty for information.

Which 2004 email worm spread faster than any before it and aimed a flood of traffic at the SCO Group's website?

Mydoom broke the speed records set by Sobig and ILOVEYOU, and although security firms believed it came from a programmer in Russia, its author was never identified.

Which worm, first detected in 2008 and also called Downadup, infected millions of PCs and the French Navy's network?

Conficker left French military aircraft at several airbases grounded, because their flight plans could not be downloaded while the infected network was sealed off.

The 2017 NotPetya attack began with a poisoned update to tax accounting software widely used in which country?

Ukraine took about 80% of the infections, because the M.E.Doc package that delivered the malware was used by roughly nine in ten of the country's firms.

Which banking malware, first identified in 2007 at the US Department of Transportation, logs victims' keystrokes?

Zeus let criminals capture online banking passwords and drain accounts thousands of dollars at a time, routing the cash through networks of paid money mules.

In 2005 which record company was caught selling music CDs that secretly installed a rootkit on buyers' computers?

Sony BMG had put the hidden copy-protection software on about 22 million CDs, and after lawsuits and government investigations it recalled some and abandoned CD copy protection.

Cabir, thought to be the first worm to infect mobile phones, spread in 2004 using which wireless technology?

Bluetooth let Cabir hop to any phone nearby, and it would even try to send itself to printers and desktop computers that accepted wireless file transfers.

Shamoon, a virus that wiped about 30,000 workstations in 2012, was aimed at which national oil company?

Saudi Aramco needed more than a week to restore its services after the attack, which a group calling itself the Cutting Sword of Justice claimed.

The 1988 Morris worm was released from which university's network to hide that its author studied at Cornell?

MIT was only a decoy launch point, chosen so the worm could not be traced straight back to its creator; it went on to infect around 6,000 Unix machines.

Robert Tappan Morris, creator of the 1988 internet worm, later co-founded which start-up funding firm with Paul Graham?

Y Combinator followed the pair's earlier venture Viaweb, one of the first web applications, and Morris also went on to become a tenured computer science professor.

Which co-inventor of RSA encryption did Fred Cohen credit in 1984 with coining the term 'computer virus'?

Leonard Adleman, the A in RSA, was teaching the class in which Cohen wrote his experimental virus, and he later won the Turing Award and founded the field of DNA computing.

The computing term 'worm' was coined in which 1975 science-fiction novel by John Brunner?

The Shockwave Rider follows a fugitive hacker who rewrites a 'computer tapeworm' loose in a surveillance state's data network, then releases one built to destroy all secrecy.

Dark Avenger, a virus writer who gained notoriety in the early 1990s, came from which Eastern Bloc country?

Bulgaria's government had backed projects to reverse-engineer Western technology, and after a local magazine explained how viruses were written, a wave of home-grown ones erupted.

Stoned, a 1987 virus that demanded marijuana be legalised, is thought to be a student's work in which country?

New Zealand's capital, Wellington, is where it is believed to have been written, and an infected PC had a one-in-eight chance of declaring itself stoned on screen.

Which company bought Peter Norton Computing in 1990 and went on to sell Norton AntiVirus under the founder's name?

Symantec had entered the field a year earlier with an antivirus product for the Macintosh, then put the better-known Norton name on its PC software.

John Shoch and Jon Hupp ran the first research into helpful worm programs in the late 1970s at which research lab?

Xerox PARC's worms were meant to be useful, roaming a network of the lab's Alto computers to put its new Ethernet technology to the test.

Good Times, a 1994 warning to delete a supposedly virus-carrying email unread, turned out to be what?

An internet hoax is all it was, and the hacker collective Cult of the Dead Cow later claimed to have started it to prove how gullible self-proclaimed experts were.

What name is given to antivirus detection that uses rules of thumb to catch new viruses instead of exact matches?

Heuristic analysis often means running a suspect file inside an isolated virtual machine and watching what it tries to do before it gets near the real one.

Microsoft introduced which monthly security-update routine in October 2003?

Patch Tuesday bundles a month of fixes for release on one known date, which cut Microsoft's distribution costs and let system administrators prepare.

The ILOVEYOU worm's attachment posed as a text file but was really a script in which Microsoft language?

VBScript files end in .vbs, an extension that stayed hidden from victims, so the attachment looked like a plain .txt file that could not possibly carry malware.