What was the first intentional malware that got spread over multiple machines?

Question

I would like to know which program can be seen as the first malware.

To define the term "malware" in this question, I would suggest those criteria, but you may modify them if you feel the need:

• real program, not just fiction
• written intentionally and not by accident
• able to infect a computer without the user's permission
• running malicious code on the target machine (spying, destroying data or even just printing a joke)
• able to replicate itself and autonomously infect further computers
• managed to escape the environment it was created in and infected foreign devices

Who wrote this first malware, when, why (if known), for what target computers/operating systems and how exactly did it work?

Answer 1

The first computer worm is reckoned to be Creeper, which was written by Bob Thomas in 1971 and extended by Ray Tomlinson. It targeted DEC PDP-10 computers running TENEX. It would print "I'm the creeper: catch me if you can" on infected computers. It started off as an experiment to demonstrate the ability to run software remotely, and move software around to take advantage of lightly-loaded systems; it did this using TENEX's RSEXEC server, and as such relied on the general openness of systems back then rather than exploiting a security hole. There's an interesting interview of Ray Tomlinson which covers this in a little more detail.

Answer 2

One of the first viruses to gain widespread attention was "The Brain." Two brothers from Lahore, Pakistan had written a heart monitoring program, and realized it was being copied and distributed illegally. So in 1986, they released a version of their software (as well as other pirated bootleg titles) that contained "The Brain," kind of as an experiment.

Essentially it would copy the boot sector of the floppy (or hard drive) to another part of the disk, and mark is as "bad." It would then alter the disk label to "©Brain" and replace the boot sector with a copy of the virus.

The boot sector also contained the following text:

Welcome to the Dungeon (c) 1986 Basie & Amends (pvt) Ltd VIRUS_SHOE RECORD V9.0 Dedicated 
to the dynamic memories of millions of viruses who are no longer with us today - Thanks 
GOODNESS!! BEWARE OF THE er..VIRUS : this program is catching program follows after these
messages....$#@%$@!!

And...

Welcome to the Dungeon © 1986 Brain & Amjads (pvt). BRAIN COMPUTER SERVICES 730 IZANAMI
BLOCK ALLAMA IQBAL TOWN LAHORE-PAKISTAN PHONE: 430791,443248,280530.
Beware of this VIRUS....  Contact us for vaccination...

In addition to that, "The Brain" also caused hard disks to slow over time, and even led to data loss. From Going Viral: How Two Pakistani Brothers Created the First PC Virus:

Shortly after the University of Delaware outbreak, Brain began popping up at other universities, and then at newspapers. The New York Times reported that a “rogue computer program” had hit the Providence Journal-Bulletin, though the “damage was limited to one reporter losing several months of work contained on a floppy disk.”

What's interesting about "The Brain," was that it didn't infect other computers over the internet. It relied on users to spread it inadvertently via floppy disks. From the same article mentioned/quoted above, the brothers were quite shocked at the size of the response:

Basit and Amjad began receiving calls from all over the world. They were as surprised as anyone that their little experiment had traveled so far. After all, unlike today’s computer viruses, which spread at lightning speed, Brain had to transmit itself the old-fashioned way—through human carriers toting around 5.25-inch floppy discs.

And as much as I hate referencing things on Wikipedia, here's a link to the Wikipedia article on "The Brain": Brain (computer virus)

Answer 3

One of the earliest -- if not the earliest -- microcomputer virus is Elk Cloner, an Apple II virus created in the early 1980s as a practical joke. An infected version of DOS would install itself into the boot tracks when a non-infected floppy was accessed, and then write a signature in the VTOC to avoid re-infecting disks. After a certain number of operations, the virus would put a poem on the screen.

While not deliberately destructive, it overwrote the DOS image on floppies with little regard for caution, potentially overwriting data stored in tracks 1 and 2.

Wikipedia has an entry on Elk Cloner, and apple2history.org has a long description of Apple II viruses.

(On a personal note, I was once given a disk with one of these DOS-stomping viruses, but this one was deliberately malignant. The noisy nature of the old Disk ][ drives saved me though: after booting the infected disk, I inserted a different floppy, and asked for a catalog. Normally that just seeks to track 17, but I heard the drive head move back to the start of the disk, seek twice to nearby tracks, and then seek back to track 17 before displaying the file list. I knew something was off and scrubbed the DOS image on my floppy, then played with the infected disk until it erased itself.)

Answer 4

The first computer virus (as opposed to a worm that exploited network or boot code; though I make the distinction as a way to present this answer, not as an example of pedantry) was probably created by Fred Cohen as part of his research into into parasitic, self-replicating applications in 1983.

Cohen does not give any of his early experiments names in his historical overview of the subject in "A Short Course on Computer Viruses", but there are plenty of details about the modes and environments they chose.

Cohen is considered the first to coin the term "computer virus" to describe the programs and the mechanisms by which they spread.

Of course, none of this work was "malicious" in nature, as Cohen was interested in the computer science of parasitic programs and possible positive uses for them. So this answer may not satisfy the requirement that the payload be "malicious." I present this to illustrate that early viruses actually weren't interested in malicious payloads.