Famous computer viruses and malware outbreaks include Brain, the Morris Worm, Melissa, ILOVEYOU, Mydoom, Conficker, Stuxnet, WannaCry and NotPetya. Some were true computer viruses, while others were worms, trojans or ransomware that became widely known as “viruses” in everyday conversation.
These attacks matter because each one changed how people understood cyber threats. Early viruses spread through floppy disks and infected documents. Later worms travelled through email and computer networks, while modern ransomware and destructive malware disrupted hospitals, manufacturers, government services and international businesses.
Looking at famous computer viruses in history also shows that malware is not one fixed threat. The technology, motives and scale have changed considerably. This guide explains what computer viruses are, what are famous computer viruses & why famous outbreaks became so damaging and what modern users can learn from them.
What Is a Computer Virus?
A computer virus is malicious code that attaches itself to a legitimate file, document, application or part of a computer system. When the infected host is opened or activated, the virus can run, reproduce and infect other suitable files.
A true virus usually depends on a host. This is the main distinction between a virus and a computer worm. A worm can generally operate and spread as an independent program, often moving automatically between connected systems.
Viruses may carry a payload in addition to their ability to replicate. The payload is the unwanted action performed by the malicious code. It might corrupt files, change system settings, display messages or interfere with normal computer operations.
Some viruses are destructive, but others focus mainly on spreading. Even then, uncontrolled replication can overwhelm systems, consume resources and make trusted files unreliable.
Why Are So Many Worms and Ransomware Attacks Called Viruses?
In everyday language, “computer virus” became a general name for almost any malicious program. This happened because viruses were among the earliest digital threats widely discussed by the public.
Security professionals use more precise categories. A worm spreads independently, a trojan disguises itself as something legitimate, and ransomware blocks access to information or systems, usually while demanding payment.
This means several famous “computer viruses” were not technically viruses. ILOVEYOU, Mydoom and Conficker were worms. WannaCry combined ransomware with worm-like spreading, while NotPetya was destructive malware that presented itself in a ransomware-like form.
The distinction is useful because each threat spreads differently. However, all these incidents belong in the same historical discussion because they transformed public understanding of malware and influenced modern cyber defence.
Famous Computer Viruses and Malware at a Glance
| Malware | Year widely recognised | Main category | Why it became famous |
| Brain | 1986 | Boot-sector virus | One of the first widespread IBM PC viruses |
| Morris Worm | 1988 | Worm | One of the earliest major internet outbreaks |
| Michelangelo | 1991–1992 | Boot-sector virus | Intense public concern over a date-triggered payload |
| Melissa | 1999 | Macro virus | Spread through Word documents and Outlook contacts |
| ILOVEYOU | 2000 | Mass-mailing worm | Used a persuasive email subject and spread globally |
| Mydoom | 2004 | Email worm | Rapid email spread, backdoor access and denial-of-service activity |
| Conficker | 2008 | Network worm | Exploited unpatched Windows systems and weak passwords |
| Stuxnet | 2010 | Industrial-control worm | Targeted physical industrial processes |
| WannaCry | 2017 | Ransomware with worm-like spread | Caused worldwide disruption, including UK health services |
| NotPetya | 2017 | Destructive malware | Spread internationally and caused major business losses |
1. Brain: An Early PC Virus
Brain appeared in 1986 and is widely remembered as one of the first computer viruses to spread across IBM-compatible personal computers.
It infected the boot sector of floppy disks. At the time, floppy disks were a normal way to install software and move files between computers. When people shared an infected disk, they could unknowingly carry the virus to another machine.
Brain did not resemble modern ransomware or information-stealing malware. Its historical importance comes from demonstrating how malicious code could travel with ordinary removable media and cross international borders.
The virus also showed how closely malware reflects the technology of its period. In the 1980s, internet access was not part of everyday personal computing. Physical disks performed the role later played by email attachments, websites and cloud storage.
The lesson remains relevant. The delivery method changes, but trusted media and familiar tools can still carry malicious code.
2. The Morris Worm: The Internet’s Early Warning
The Morris Worm was released in 1988 and became one of the first major attacks to spread across the early internet.
It was a worm rather than a true virus because it did not need to attach itself to an ordinary host file. It used weaknesses and trust relationships within connected Unix systems to copy itself from one computer to another.
A programming feature intended to help the worm avoid disappearing caused it to reinfect systems repeatedly. This consumed resources and made affected computers slow or unusable.
The internet was far smaller than it is today, but the outbreak still caused serious disruption. It revealed that connectivity could turn one piece of self-replicating code into a widespread incident.
The case also influenced the development of organised computer emergency response. It made clear that organisations needed ways to share threat information and coordinate action during rapidly spreading incidents.
3. Michelangelo: A Virus and a Media Event
Michelangelo was a boot-sector virus that became widely known in the early 1990s. It was designed to activate on 6 March, the birthday of the artist Michelangelo.
The virus could overwrite areas of storage on infected systems, making information inaccessible. Before its expected activation date in 1992, warnings about possible global damage received extensive media attention.
The actual impact was lower than some of the most alarming predictions. Even so, Michelangelo became an important moment in the public history of computer security.
It showed how a malware threat could become a major social and media event before its payload activated. It also encouraged computer users to take antivirus software and preventive scanning more seriously.
Another lesson was the difficulty of estimating infection levels. Security teams need to communicate risk clearly without either minimising a threat or presenting uncertain worst-case outcomes as guaranteed facts.
4. Melissa: The Macro Virus That Filled Email Systems
Melissa appeared in March 1999 and was one of the best-known true computer viruses of the email era.
It arrived inside a Microsoft Word document containing a malicious macro. When the document was opened, the macro used Microsoft Outlook to send copies of the infected file to addresses from the victim’s contact list.
The message appeared to come from someone the recipient knew. This made the attachment more convincing and helped the virus spread quickly.
Melissa was not famous mainly for destroying individual computers. Its rapid distribution overwhelmed email systems and forced some organisations to temporarily shut down parts of their messaging infrastructure.
The attack showed how malware could exploit trusted relationships. A familiar sender was no longer proof that a document was safe because the sender’s system might be infected.
Melissa also changed workplace security. Organisations introduced stronger email filtering, limited automatic macro behaviour and placed greater emphasis on attachment awareness.
5. ILOVEYOU: Social Engineering on a Global Scale
The ILOVEYOU outbreak began in May 2000 and became one of the most recognised malware incidents in history.
Victims received an email with the subject “ILOVEYOU” and an attachment presented as a love letter. The emotional and personal appearance of the message encouraged many recipients to open it.
Once activated, the malicious script changed files and sent copies of itself to contacts found in Microsoft Outlook. Because the message appeared to come from a known person, each new email carried built-in credibility.
ILOVEYOU is commonly called a virus, but it is more accurately classified as a mass-mailing worm. It could spread through email and other channels without behaving like a traditional host-dependent file virus.
Its importance lies in the combination of technical code and social engineering. The attachment did not succeed only because of a software weakness. It succeeded because the message created curiosity and appeared to come from someone trusted.
Modern phishing campaigns still use the same principle. The wording has changed, but urgency, emotion and familiarity remain powerful ways to influence people.
6. Mydoom: The Fast-Moving Email Worm
Mydoom emerged in January 2004 and became one of the most significant mass-mailing worms of its period.
It spread through email messages with infected attachments and searched compromised computers for additional email addresses. Some versions also used peer-to-peer file-sharing locations.
Mydoom did more than reproduce. It could install a backdoor, allowing unauthorised remote access to an infected computer. Some variants were also associated with denial-of-service activity against selected websites.
The worm demonstrated how malware could combine several purposes. One component handled rapid distribution, while another created continued access for attackers.
Mydoom’s email traffic placed pressure on networks and messaging systems. It also showed that attackers were moving beyond disruption towards building groups of compromised devices that could be used for later activity.
The main historical lesson is that opening one attachment may affect far more than the first computer. A compromised machine can become part of an infrastructure used for spam, further malware delivery or coordinated cyber attacks.
7. Conficker: The Persistent Network Worm
Conficker was discovered in 2008 and became one of the most widespread and persistent worms targeting Microsoft Windows systems.
Its original versions exploited a known weakness in the Windows Server service. Later versions could also spread through network shares, removable drives and weak administrator passwords.
Conficker attempted to disable or interfere with important system services and security products. It also created a large network of compromised devices that could receive further instructions.
The worm was difficult to remove from large networks because an unclean or unpatched computer could reintroduce it to systems that had already been repaired.
Conficker became a major lesson in basic cyber hygiene. A security update for the exploited vulnerability was available, yet many devices remained exposed. Weak passwords and uncontrolled removable media added more ways for the worm to spread.
Its long life also demonstrated the challenge of unmanaged technology. Even when large organisations improve their defences, old personal computers, unsupported systems and forgotten devices can keep a malware family active.
8. Stuxnet: Malware Reaches Industrial Systems
Stuxnet was discovered in 2010 and marked a turning point in the history of cyber attacks.
It was designed to target particular industrial-control environments. Rather than simply stealing documents or disrupting office computers, it attempted to manipulate physical industrial processes while concealing aspects of its activity.
Stuxnet used several sophisticated techniques and vulnerabilities to spread and reach its intended targets. It also showed that disconnected or highly restricted environments could still be exposed through removable media, engineering systems and trusted operational processes.
The malware is usually described as a worm rather than a traditional virus. Its historical significance is much larger than its classification.
Stuxnet demonstrated that malicious software could cross the boundary between digital systems and physical equipment. After its discovery, governments and industries paid much more attention to the security of operational technology, industrial controllers and specialist engineering workstations.
The event remains a reminder that cyber security is not only about protecting emails and customer records. In some environments, a malware infection can affect machinery, production and physical operations.
9. WannaCry: Ransomware with Worm-Like Speed
WannaCry spread internationally in May 2017 and became one of the most famous ransomware attacks in history.
The malware encrypted files and displayed a payment demand. What made the outbreak particularly damaging was its ability to spread automatically between vulnerable Windows systems.
WannaCry affected organisations in many countries. In the UK, disruption to NHS services made the incident especially visible. Appointments and other services were affected as organisations responded to infected or at-risk systems.
It is often called the WannaCry virus, but the more accurate description is ransomware with worm-like spreading capability.
The attack highlighted several weaknesses at once. Some affected systems had not received an available security update, while older and unsupported technology increased operational difficulty. Networks also allowed the malware to move from one vulnerable device to another.
WannaCry became a clear argument for prompt patching, accurate asset inventories and network segmentation. It also showed why organisations need downtime procedures and tested backups before an emergency occurs.
10. NotPetya: Destruction Disguised as Ransomware
NotPetya appeared in June 2017, only weeks after WannaCry. It displayed a ransom message and encrypted or damaged information, but it did not provide victims with a realistic method of recovering their systems through payment.
For this reason, it is more accurately understood as destructive malware or a wiper presented in ransomware-like form.
The attack initially affected organisations in Ukraine and then spread through connected international businesses. Shipping, manufacturing and other sectors experienced extensive operational and financial damage.
NotPetya showed how an incident aimed at one region or software ecosystem can create global consequences. Multinational businesses share networks, credentials, suppliers and applications across borders.
It also demonstrated that a payment demand does not always mean the attacker genuinely intends to provide recovery. Some malware uses the appearance of ransomware to disguise destruction.
The outbreak encouraged organisations to examine supply-chain risk, network separation and recovery arrangements across international operations.
Other Famous Virus Outbreaks Worth Knowing
Several other incidents helped shape cyber history.
The CIH virus, also known as Chernobyl, was a file-infecting virus from the late 1990s. Its destructive payload could damage information and interfere with low-level system operations on some computers.
Code Red was a worm that spread in 2001 by exploiting a vulnerability in Microsoft Internet Information Services. It showed how internet-facing servers could be scanned and compromised automatically.
SQL Slammer appeared in 2003 and spread rapidly by exploiting vulnerable database software. Its speed caused major network congestion and service disruption.
Sasser, discovered in 2004, was another network worm that exploited a Windows vulnerability. Unlike email worms, it did not require a person to open an attachment before it could spread between vulnerable systems.
These incidents reinforced a lesson that would later appear in Conficker and WannaCry: once automated malware starts scanning for exposed systems, organisations may have very little time to respond.
From Pranks to Cyber Crime and Destructive Attacks
The motives behind malware have changed over time.
Some early computer viruses were created as experiments, demonstrations or digital pranks. Their creators might have wanted recognition, curiosity or proof that they could make code spread.
As more business, communication and financial activity moved online, malware became increasingly profitable. Trojans stole banking details, botnets distributed spam and ransomware created direct opportunities for extortion.
Malware also became a tool for espionage and state activity. Stuxnet demonstrated targeted interference with industrial operations, while NotPetya showed the scale of damage that a destructive campaign could cause beyond its initial area of focus.
Modern attacks are often organised like businesses. One criminal group may steal access, another may operate malware infrastructure and another may carry out extortion. This is very different from the image of one person writing a virus for attention.
What are famous computer viruses & What Made These Outbreaks Spread So Widely?
The famous attacks used different technologies, but they repeatedly exploited a few common conditions.
First, they used trust. Melissa and ILOVEYOU appeared to come from familiar contacts. Users opened the attachments because the messages did not look completely random.
Second, they found repeated technical weaknesses. Mydoom used email and file-sharing behaviour, while Conficker and WannaCry reached many devices that shared the same unpatched vulnerability.
Third, networks allowed local infections to become large incidents. A worm does not need to persuade every user individually when it can move automatically between vulnerable systems.
Finally, organisations often lacked visibility. They did not always know which devices existed, which software versions were installed or whether an important patch had failed.
Malware outbreaks become historic not only because the code is clever, but because the surrounding environment allows that code to spread.
The Difference Between Viruses, Worms and Ransomware
Understanding the categories helps explain why each event behaved differently.
A virus attaches itself to a host file or system area. Brain, Michelangelo and Melissa are examples of true viruses.
A worm spreads independently, often through email, networks or software vulnerabilities. Morris, ILOVEYOU, Mydoom and Conficker are better described as worms.
Ransomware prevents access to information and demands payment. WannaCry combined this extortion model with worm-like spread. NotPetya looked like ransomware but was primarily destructive.
One malware family can show several characteristics, so classification is not always simple. The useful question is not merely “What is it called?” but “How does it enter, spread and cause harm?”
How Antivirus Software Changed
Early antivirus tools depended heavily on signatures. A signature is a recognisable pattern associated with known malicious code.
This approach worked well when a particular virus had a relatively stable appearance. As malware became more varied, attackers started changing their code to avoid simple detection.
Modern security products also examine behaviour, reputation, unusual processes and suspicious file changes. They may block a program because it begins encrypting many files or attempts to disable security controls.
Antivirus software remains important, but history shows why it cannot be the only defence. A new worm may spread before signatures are widely available, and a stolen administrator account may allow attackers to operate using legitimate tools.
What History Teaches About Preventing Malware
The most important lessons are surprisingly consistent.
Systems and applications should be updated promptly, especially when they are exposed to the internet. Conficker and WannaCry showed how known vulnerabilities can remain dangerous when updates are delayed.
Users should treat unexpected files and download requests carefully, even when the message appears to come from someone familiar. Melissa and ILOVEYOU spread through trust as much as technology.
Organisations also need network segmentation. One infected workstation should not be able to reach every server, backup and business system without restriction.
Reliable backups support recovery from ransomware and destructive malware. At least one copy should be protected from the accounts and devices it is intended to recover.
A strong modern defence usually combines:
- Security updates and supported technology
- Endpoint or antivirus protection
- Strong authentication and limited privileges
- Email and web filtering
- Network segmentation
- Protected, tested backups
- Security monitoring and incident response
No one control guarantees protection, but several layers can stop an infection from becoming a major outbreak.
What Should You Do If Malware Is Suspected?
Stop using the affected device for ordinary work and report it through the appropriate support or security process.
The device may need to be isolated from networks to reduce further spread. In an organisation, this should follow the incident-response plan so that evidence and essential services are not damaged unnecessarily.
Do not download random removal tools or delete unfamiliar system files. Serious infections can hide in several locations, and unplanned actions may make investigation more difficult.
Security teams should determine how the malware arrived, which systems were affected and whether credentials or information were compromised. They may need to rebuild devices from a trusted source rather than relying on a quick scan.
Passwords used on an infected computer may need to be changed from a clean device. Backups should be checked before restoration so that infected files are not reintroduced.
Common Myths About Famous Computer Viruses
One common myth is that every famous malware outbreak was a virus. In fact, many of the most important incidents were worms or ransomware.
Another myth is that old malware no longer matters. The original code may be outdated, but the weaknesses it exposed—unpatched systems, trusted attachments and flat networks—still appear in modern incidents.
People also assume that antivirus software alone would have stopped every outbreak. Security tools are valuable, but major incidents often involve delayed updates, poor access controls or rapid spread before detection catches up.
Finally, paying ransomware does not guarantee recovery. NotPetya showed that some destructive attacks may use a ransom message without providing a workable path to restore data.
Frequently Asked Questions
What are the most famous computer viruses in history?
Well-known examples include Brain, Michelangelo and Melissa. Famous malware commonly called viruses also includes the Morris Worm, ILOVEYOU, Mydoom, Conficker, Stuxnet, WannaCry and NotPetya.
Was ILOVEYOU a computer virus?
It is commonly called the ILOVEYOU virus, but Microsoft classifies LoveLetter as a family of mass-mailing worms. It spread through email attachments and Outlook contacts.
What was Mydoom?
Mydoom was a family of mass-mailing worms that spread mainly through email. Some versions created backdoor access and carried out denial-of-service activity.
Is Conficker still considered a virus?
Conficker is technically a worm. It spread through a Windows vulnerability, network shares, removable drives and weak passwords.
Was WannaCry a virus or ransomware?
WannaCry was ransomware with worm-like spreading capability. It encrypted files and moved automatically between vulnerable Windows systems.
What is the difference between WannaCry and NotPetya?
Both spread widely and caused disruption in 2017. WannaCry presented a ransomware payment process, while NotPetya was primarily destructive and did not provide a realistic recovery route through payment.
Why was Stuxnet historically important?
Stuxnet targeted industrial-control processes, demonstrating that malware could affect physical equipment rather than only ordinary computers and data.
Which famous malware spread through email?
Melissa, ILOVEYOU and Mydoom are major examples. Each used email in a different way to reach more victims.
Can famous old viruses infect modern computers?
Many original versions target old software and may not work properly on modern systems. However, their techniques and lessons remain relevant, and unsupported technology can still be exposed.
What is the best protection against malware attacks?
Use current software, active endpoint protection, strong authentication, limited privileges, network segmentation, careful handling of files and tested backups.
Conclusion
The history of famous computer viruses begins with boot-sector infections such as Brain and extends to email outbreaks, network worms, industrial malware and global ransomware incidents.
Not every famous “virus” was technically a virus. Melissa was a macro virus, while ILOVEYOU, Mydoom and Conficker were worms. WannaCry was ransomware with worm-like spread, and NotPetya was primarily destructive malware.
Their differences matter because they explain how cyber attacks evolved. Floppy disks gave way to email, email gave way to automated network exploitation, and malware increasingly became connected to cyber crime, espionage and operational disruption.
The historical lessons remain practical. Keep systems updated, question unexpected attachments, restrict access, separate important networks and maintain reliable backups.
Malware technology will continue to change, but famous outbreaks repeatedly show the same truth: one weakness becomes far more dangerous when it is shared across many users, devices or organisations.