The Worst PC Viruses of All Time

History tells us it all began with the Creeper worm in 1971, but no one could imagine that the concept of computer viruses would evolve into something so destructive. Today we use the generic term malware for most infections, but in the last two decades we’ve seen devastating specimens that caused billions of dollars in losses and gave rise to new variants. Today we remember some of the worst viruses that hit our PCs, and I hope readers share their own experiences and suggestions.

From the political message of Stoned and the media frenzy around Michelangelo to the physical attacks of Stuxnet and the “digital kidnapping” of files with ransomware, we’ve seen it all in the world of computer viruses. Security solutions evolved, but so did the opposite side, and today we find highly sophisticated specimens with truly impressive distribution capabilities.

It’s also necessary to recognize that hyperconnectivity and mobile devices make things much more complicated for users these days, but it’s not impossible to maintain a decent defense. In recent years we’ve seen mass infections that surprised millions of people, easily exploiting existing vulnerabilities. How about we remember some of the worst? Let’s see…

CIH

Many know it as “Chernobyl” because some variants shared an activation date with the historic nuclear accident in the Soviet Union, but the most chilling part of the CIH was its destructive potential. It was discovered in 1998, though its peak activity came in 1999, rewriting the first 1,024 kilobytes of a hard drive with zeros and attacking certain types of BIOS. Over time, recovery methods emerged, but to the average user, CIH could completely ruin a computer.

Melissa

On March 26, 1999, David L. Smith put twenty percent of global systems at risk with Melissa, a macro virus that combined natural vulnerabilities in email clients like Outlook, lack of security in macro interpretation in Word, and a good dose of social engineering. Clicking the attached file automatically infected the computer, and the virus sent itself to the first fifty addresses in the address book. Smith was sentenced to twenty months in federal prison, three years of supervised release, one hundred hours of community service, and a fine of five thousand dollars.

ILOVEYOU

Also known as Love Letter, this Visual Basic script began its mischief on May 4, 2000. Originating from the Philippines, ILOVEYOU used a distribution mechanism similar to Melissa’s, but instead of exploiting macro weaknesses, its supposed creators (who avoided justice due to legal loopholes) disguised a .VBS file as a text document. ILOVEYOU was particularly destructive because it renamed personal and system files, changing extensions. It’s estimated to have infected more than 50 million systems in ten days, causing between five and nine billion dollars in damages.

The entire year 2003

The year 2003 was especially dark for computer security, and the reason is that it gave birth to truly harmful specimens.

• Between January 24 and 25, SQL Slammer “broke the internet” by knocking out routers with excessive traffic around the globe, exploiting a vulnerability in Microsoft SQL Server and MSDE, for which the Redmond giant had released a patch six months earlier (and apparently few applied).
• On August 12, I witnessed the bombing caused by the Blaster worm, which by causing a buffer overflow in Windows’ RPC service, forced users to restart the system.
• Welchia aimed to remove Blaster from the system, install the necessary patches, and thus prevent reinfection, but it also used a vulnerability in its distribution.
• Sobig caused such a spike in spam distribution that Microsoft offered a $250,000 reward for the arrest of its creator.
• In October, the first version of the Sober worm was detected, which would cause many headaches two years later.
• 2004 wouldn’t be much better, courtesy of MyDoom and Sasser.

Conficker

This little demon claimed a good part of my time in April 2009, and although several non-specialist media ended up exaggerating its impact, no one denies that it showed a certain preference for government buildings, hospitals, and even military bases. The simple act of removing Conficker and restoring the services that its variants knocked out (Windows Update, Windows Defender, BITS, etc.) raised its damages to more than nine billion dollars. The worst part? Conficker refused to die and for many years continued to infect computers.

With special emphasis on 2003, these are the worst viruses (in our opinion) of recent years. Want to share your experiences with any of them? Do you think the list deserves another entry? Leave a comment, and as always, keep your system safe. Malware only needs to be lucky once.