Computing’s 11 Smartest Super-Viruses--And The Damage They Wrought | Fast Company | Business + Innovation The Morris Virus (1988) Robert Morris's worm infected 10% of computers online at the time—around 6,000 machines. Morris built the virus to test the size of the Internet, when he was a grad student at Cornell. The bug slowed infected computers to a halt, prompting the government to sue. Under the Computer Fraud and Abuse Law, in December 1990, Morris became the first virus-maker convicted in U.S. court. This first criminal hacker's legal troubles were ironic: His dad, a coauthor of UNIX, was the former chief scientist of the National Computer Security Center for the NSA. The harm was done by mistake: Morris designed his bug to replicate in 14% of cases, even if it detected a copy of itself, as a safeguard against security programs trying to outsmart it. This extra load of viral copies drew administrators' notice, and inadvertently clogged infected computers. Due to "potential loss in productivity," the Morris worm cost between $200 and $53,000 per infected system, authorities estimated.

Morris was sentenced to three years of probation, 400 hours of community service, a fine of $10,050, and the costs of his supervision. Morris bounced back in later years. In 1995, he cofounded Viaweb, a startup that made software for building online stores. Viaweb sold for $48 million in 1998, to Yahoo. The next year, he got his PhD from Harvard. In 2006, the once-infamous hacker cofounded Y Combinator, the seed-stage startup funding firm. The next year, he got tenure as a computer science prof at the hacker school where his rep might be best appreciated: MIT. Chernobyl Virus/CIH or "Spacefiller" (1998) Chernobyl gets its name from its trigger date: April 26, the anniversary of the 1988 nuclear disaster. Created far from the former USSR, in Taiwan, the virus is only associated with the incident by coincidence—a red herring to investigators. Chernobyl, also known as CIH, effectively paralyzes a computer by overwriting a chip inside PCs.

The author, Chen Ing-hau, then a college student at Tatung University, was caught by Taiwanese police. His virus infected 60 million computers and caused U.S. $1.6 billion in damages. Since the Taiwanese government was unable to prosecute Chen—no victims came forward to sue—the virus led to new anti-malware legislation in Taiwan. Chernobyl is sometimes called "spacefiller" because it works differently than other computer worms, in a way that brings to mind DNA insertion by biological viruses. While most viruses add their code to the end of an infected file, this one looks for gaps in code to add its own. Since the "insertion" doesn't change the infected file's size, it makes the virus harder to detect. Chernobyl is an example of how computer viruses, much like the organic ones that give them their name, evolve to exploit weaknesses in their hosts. The Melissa Virus (1999) If you want a virus with personality, look no further than Melissa: Named for a Miami stripper, she was made by a porn-fiend fan of The Simpsons, who ended up behind bars when his email-Frankenstein invaded Microsoft and Intel.

By the time the 30-year-old was arrested, Melissa was the worst computer virus outbreak to date. The first ever email-aware virus hid inside an attachment called "List.DOC," which contained a list of 80 passwords to porn sites. Spreading through Microsoft Outlook emails, it hijacked infected address books, sending itself to the first 50 contacts. In a subset of cases—whenever the day of the month and minute coincided—Melissa printed a line of text at the current cursor position in a Microsoft Word doc: "Twenty-two points, plus triple-word score, plus fifty points for using all my letters. Game's over. I'm outta here": a quote from Bart Simpson about Scrabble. Unleashed by New Jersey hacker David L. Smith on the alt.sex newsgroup, the quirky virus wasn't meant to do harm, just mischief. But Melissa got out of hand: On March 26, she clogged Microsoft's and Intel's email servers. The tech juggernauts sought vengeance, after an estimated $80 million worth of damages: The FBI, New Jersey state police, AOL, and a Swedish computer scientist collaborated to hunt down the horny hacker, who was arrested on April 1.

Melissa cost her maker a 10-year prison sentence (he served 20 months), plus a $5.000 fine. She showed hackers the potential real-world consequences of cyber play. The I LOVE YOU Virus (2000) Imagine a computer virus that operates like a lover-boy con artist: It exploits lonely people, stealing by seducing. This bug isn't a cyber spy, terrorist, or identity thief, but in a way, it's more malicious: It gets in your head. And takes your stuff when it leaves. The Trojan Horse that arrived in millions of email boxes on the morning of May 5, 2000 carried an email attachment labeled "I Love You." Recipients expecting a secret admirer's confession got a rude surprise: When the doc was opened, all image files on the computer were overwritten. Photos of family, friends, lovers and pets—all deleted in a flash by the would-be Internet Romeo. The psychological weapon then launched anew, sending itself to the first 50 contacts in the user's Windows address book. I LOVE YOU spread like a sexually transmitted disease out of southeast Asia.

It was unleashed on May 5, 2000 near Manila, in the Philippines, and chased daybreak across the world: first to Hong Kong, then Europe, and finally the U.S., when people began work that Friday morning. It was later estimated to have caused U.S. $5.5-8.7 billion in damages internationally and cost around $15 billion to remove. To protect themselves, the CIA, Pentagon, and many major corporations chose to shut down their email systems. The worm ended up affecting 45 million computers, making I LOVE YOU one of history's most dangerous computer disasters. The Filipino authorities arrested two college students alleged to have released I LOVE YOU, but the hackers couldn't be charged since the state had no law against malware. In July 2000, two months after the outbreak, the Philippine Congress passed its E-Commerce Law to protect against future worms. You might call it the Miss Lonelyhearts virus, after the novel by Nathaniel West: a bug that preys on the human desire for love. The intensity of that longing drove the book's protagonist, a romance advice columnist, out of his mind. So might I LOVE YOU.

Code Red forced the White House's website to shut down temporarily on June 19, 2001, along with several other government agencies. Red exploited a flaw in the Microsoft Internet Information server, which allowed it to vandalize websites with its graffiti: "HELLO! Welcome to (URL redacted)! Hacked By Chinese!" Since the virus targeted U.S. government websites, it was seen as a potential cyber-attack by terrorists or a foreign government (like... China?), but the hacker is unknown. This cyber villain got its name, as usual for computer viruses, from a coincidence. The security investigators at eEye Digital Security who first chased the bug were drinking Code Red Mountain Dew at the time. Red infected 359,000 computers at its peak, on June 19. "Hacked By Chinese!" became an Internet meme representing online defeat. Its claim to fame is that it was the first virus to push around the White House— though its sophomoric vandalism would be upstaged by its more sinister successor, agent.btz. Check out Virus #9 for more information.

The Anna Kournikova Worm (2001) The Anna Kournikova Worm posed as a photograph of the sexy tennis player, but was actually a virus made by Dutch fanboy Jan de Wit, on February 11, 2001. "Here you have, ;0)" was the subject, "Hi: Check This!" the body of the message that carried de Wit's worm. The bait was a file labeled "AnnaKournikova.jpg.vbs." Kournikova was a tempting lure, no doubt, for male recipients: at the time, she was the face of the sports-bra maker Berlei, in its "Only the ball should bounce" billboard campaign . People voted her one of the 50 Most Beautiful People in 1998 and ESPN.com voted her "hottest female athlete." Kournikova was the most searched athlete on the Internet through 2008, the eighth most searched woman in 2001, and even one of the most searched terms on the Internet for a while.

Net surfers searched her not so much for her tennis prowess, which was good but not great (ESPN voted her the #1 "most overrated athlete" and #18 in the "25 Biggest Sports Flops of the Past 25 Years"), but for her image. The 2004 Swimsuit Issue featured photos of her which are still famous today, along with photos in Maxim and FSM . The year after the worm, she would place first in FHM's 100 Sexiest Women in The World. So, the timing could not have been riper for an Anna Kournikova worm than when it hit. De Wit was 20 when he made the virus, using a bug-making toolkit he got online from an Argentinian coder. Anna was similar to I LOVE YOU, but it didn't corrupt or delete any files on infected computers. Anna spread fast enough, though, that she got the FBI’s attention. They used David L.

Smith — author of the Melissa virus, now finished his 20-month prison sentence and still collaborating with anti-virus investigators—to find the real name, home address, and email of the coder called "OnTheFly." De Wit turned himself in on February 14, after conferring with his parents. He was prosecuted in Dutch court, and given a community service sentence—despite the FBI arguing that US$166,000 of damages were caused by Anna. The mayor of de Wit's town, Sneek, calling the virus "a joke," said his town should be proud to have produced such a talented kid, and that the tech crew at his office should interview him for a job when he finished school. The Slammer (2003) Bank of America ATMs , a 9-1-1 Emergency Response system in Washington state, and an Ohio nuclear plant were all victims of this "denial of service" attack—a flood of robo-zombie information packets that overwhelms an automated system with noise. Slammer wrought havoc fast: The virus slammed 75,000 machines within 10 minutes of being released.

Like the ingenious mind-child of a deranged James Bond villain, the bug burrowed into America's electronic systems of cash-flow, public safety, and energy, and tried to break them down. If it had succeeded—particularly in the case of the nuclear facility—the costs in money, injury, and even human life could have been catastrophic. The source of the bug is unknown. Ten years later, Slammer holds the record for the fastest spreading virus to date. Netsky & Sasser Virus (2004) German teenager Sven Jaschen was arrested on May 7, 2004 for spreading 70% of all malware on the Internet at the time. The coder admitted he'd written the viruses, known as Netsky and Sasser, but insisted he never intended harm: He saw himself as an avenger, a virus hunter. His fast-moving bugs were designed to infect computers in order to delete other viruses. The high school student learned about viruses in a computer class he was taking. At the time, the virus MyDoom had just exploded onto the Internet, eclipsing I LOVE YOU as the fastest spreading bug.

MyDoom's creator, believed to be a programmer in Russia, is unknown, but its effect was to spam millions of email boxes with the message "andy; I'm just doing my job, nothing personal, sorry." It seemed like a Distributed Denial of Service (DDoS) attack, aimed at companies, programmed to flood their systems with noise mail. When MyDoom was launched on January 26, 2004, Jaschen was a 17-year-old novice programmer, and he took the virus as a call to arms. What if he could write a bug that would outpace MyDoom and delete it? He'd become a hacker hero. The Terminator inspired Jaschen's first virus. Netsky gets its name from Skynet, the computer network that Arnold Schwarzenegger's android character fights in the Terminator movies. It was written in 2000 lines of code, which took the novice programmer weeks of after-school sessions to write. Netsky's mission was woven into the lines of code: "we are the skynet- you can't hide!

- we kill malware writers (they have no chance!) - [LaMeRz—>] - MyDoom is a thief of our idea! —<-<- ->->" Jaschen built Netsky in his parents' basement, where he chugged seltzer and listened to MTV. Netsky had some success at deleting MyDoom, until the virus writers caught on, and redoubled with new code. Jaschen countered with Sasser, which he released on his 18th birthday, April 29, and then went to sleep. The next morning is when the anti-virus virus got out of control. Since it was crudely written by a newbie coder, it accidentally caused infected machines to reboot constantly. Jaschen tried to fix the bugs in his bug by releasing frantic follow-ups, but to no avail. Within 48 hours, Sasser infected 1.3 million PCs—especially groups of PCs linked together in Windows-based local area networks common in business offices. Sasser halted rail service in Australia, paralyzed one third of Taiwan's post office, forced Finland's Sampo Bank to shut down 130 branches, and prompted Delta Airlines to cancel several transatlantic flights.

Its effects were so intense, so fast, that many businesses opted to install a new Microsoft security patch immediately. Police arrested Jaschen at his home on May 7. A year later he was sentenced to 21 months of probation, plus 30 hours of community service at a retirement home. Microsoft paid two of his high school classmates $250,000 for information leading to his arrest. On September 1, 2004, just four months after his arrest for virus-making, 18 year old Jaschen was hired as an "ethical hacker" by Securepoint, a German security company. Poison Ivy (2005) Think of this virus next time you change clothes or share a bed in front of your laptop, edit private documents, or surf embarrassing websites: Poison Ivy may be watching. This "remote access Trojan" (R.A.T.) gives the hacker full control of the hijacked computer, to record or edit content—documents, pictures, passwords, online purchases—or even use the speaker and webcam to record audio and video. Ivy can bring "eyes and ears" into your home, the way FBI surveillance characters do on the TV shows The Wire and Homeland—only this bug is wireless.

It spreads by email, quietly infecting unsuspecting computers. You may be bugged without knowing it, as you read these words. Watch out. Ivy has been used to infiltrate U.S. defense and chemical industries, according to the security firm Symantec . Nobody knows who created it, but it has been traced back to China—perhaps designed by Chinese hackers to spy on foreign governments. Ivy is very much a DIY virus, popular with amateur hackers. YouTube tutorials show cyber voyeurs how to install and use Poison Ivy from home, after disclaimers like "don’t be dumb!" The PoisonIvy-RAT.com website provides support for users, led by a mysterious character called Codius, whose email address is support@poisonivy-rat.com . So it’s not just China: Anybody with computer skills who wants eyes inside your computer has a tool to try. The Agent.btz Virus (2008) Agent.btz sparked a security scare which forced the Pentagon to issue a temporary ban on thumb drives. The U.S. Cyber Command unit, a new military group to fight online spying, was created soon after, motivated by this worst-ever cyber breach.

The outbreak started with a thumb drive left in the parking lot of a U.S. base in the Middle East. Agent.btz spreads through infected thumb drives, installing software that steals data. It works by copying existing files and replacing them with viral software, while storing the original in the background. Foreign spies presumably designed the virus, as former Deputy Secretary of Defense William Lynn III claimed in Foreign Affairs in October 2010, when the issue was declassified. The bug invaded when it was inserted into laptop at the base, which was connected to and uploaded itself onto a network run by U.S. Central Command. America’s traditional Middle Eastern enemies, like Al Quaeda, Iran, or Afghanistan, are obvious suspects. But the government either never learned the source of the thumb drive attack, or they never told us. Stuxnet (2009-2010) This little beauty was built by engineers working for the governments of the United States and Israel to fight the "bad guys." Iran, to be specific. Stuxnet was the first computer virus to cause damage not online or in computers, but in the outside world—by obstructing Iranian nukes from getting made.

Stuxnet traveled by thumb drive, like agent.btz—only this time the victim wasn't U.S. Central Command, but Iran's nuclear program. The virus worked as military sabotage in ways that previously could only be done by physical bombing, rockets, or a human spy planting explosives or snipping wires. Stuxnet targeted software controlling industrial systems in a uranium enrichment facility in Natanz, Iran. By mucking up machines, it made their centrifuges spin out of control and self-destruct, according to data from the International Atomic Energy Agency. The New York Times described the virus's development through anonymous interviews with current or previous workers on the classified project. At Stuxnet's peak, soon after the virus spread beyond Iran and was discovered, it shut down around 1,000 of the 5,000 centrifuges at Natanz. U.S. officials argued that Stuxnet set the Iranian nuclear program back between 18 months and two years. Others consider this an overstatement , and caution that U.S. involvement in cyber-warfare may give our enemies justification for their own. The case has even been made that this cyber-weapon was a net benefit to Tehran .

Good or evil aside, Stuxnet set a new standard for cyber sabotage. In the evolution of computer viruses, Stuxnet is the bleeding edge. Begging the question: What's next? [Image: Flickr user Mr.Roach ] The 18 scariest computer viruses of all time - TechRepublic TechRepublic Previous Next Anna Kournikova (2001) The Anna Kournikova virus is so named because it tricked its recipients into thinking they were downloading a sexy picture of the tennis star. Financial damages associated with Kournikova were limited, but the virus had a big pop culture impact: It became a plot point in a 2002 episode of the sitcom Friends. For more IT nightmares, check out The 10 scariest cloud outages (and lessons learned from them) from our sister site ZDNet. Image: Brock Miller/Splash News/Corbis Sasser (2004) In April 2004, Microsoft issued a patch for a vulnerability in Windows’ Local Security Authority Subsystem Service (LSASS). Shortly after, a teenager in Germany released the Sasser worm to exploit the vulnerability in unpatched machines.

Multiple variants of Sasser took out airline, public transportation, and hospital networks, causing $18 billion in damages. Image: iStock Melissa (1999) Named after a Florida stripper, the Melissa virus was designed to propagate by sending itself to the first 50 contacts in its victims’ email Outlook address book. The attack was so successful that the virus infected 20% of the world’s computers, causing an estimated $80 million in damages. Virus creator David L. Smith was caught by the FBI, served 20 months in jail, and paid a $5,000 fine. Image: iStock Zeus (2009) While many malware programs on this list are little more than nuisances, Zeus (aka Zbot) was a tool used by a complex criminal enterprise. The trojan used phishing and keylogging to steal online banking credentials, draining a cumulative $70 million from the accounts of its victims. Image: iStock Storm Trojan (2007) Storm Trojan is a particularly sinister piece of email-distributed malware that accounted for 8% of all global infections just three days after its January 2007 launch.

The trojan created a massive botnet of between 1 and 10 million computers, and because it was designed to change its packing code every 10 minutes, Storm Trojan proved incredibly resilient . Image: 20th Century Fox ILOVEYOU (2000) The ILOVEYOU worm (aka Love Letter) disguised itself in email inboxes as a text file from an admirer. But this "love letter" was anything but sweet: In May 2000, it quickly spread to 10% of all internet-connected computers, leading the CIA to shut down its own email servers to prevent its further spread. Estimated damages were $15 billion. Image: iStock Sircam (2001) Like many early malware scripts, Sircam used social engineering to trick people into opening an email attachment. The worm chooses a random Microsoft Office file on victims’ computers, infects it, and sends it to all the people in the victims’ email contact list. A University of Florida study pegged Sircam cleanup costs at $3 billion.

Image: iStock Nimda (2001) Released just after the 9/11 attacks, many thought the devastating Nimda worm had an Al Qaeda connection, though that was never proven, and then-U.S. Attorney General John Ashcroft denied any correlation. It spread via multiple vectors, bringing down banking networks, federal courts, and other key computer systems. Cleanup costs for Nimda exceeded $500 million in the first few days alone. Michaelangelo (1992) The Michelangelo virus spread to relatively few computers and caused little real damage. But the concept of a computer virus set to "detonate" on March 6, 1992 caused a media-fueled mass hysteria, with many afraid to operate their PCs even on anniversaries of the date. SQL Slammer/Sapphire (2003) Taking up just 376 bytes, the SQL Slammer worm packed a lot of destruction into a tiny package. The worm slowed down the internet, disabled 911 call centers, took down 12,000 Bank of America ATMs, and caused much of South Korea to go offline.

It also crashed the network at Ohio’s Davis-Besse nuclear power plant. Image: iStock Code Red (2001) The Code Red worm , named after the Mountain Dew flavor preferred by its creators, infected up to one-third of all Microsoft ISS web servers upon release. It even took down whitehouse.gov, replacing its homepage with a “Hacked by Chinese!” message. Estimated damages due to Code Red were in the billions of dollars worldwide. Cryptolocker (2014) Computers infected with Cryptolocker have important files on their hard drives encrypted and held at ransom . Those who pay approximately $300 in bitcoin to the hackers are given access to the encryption key; those who fail to pay have their data deleted forever. Sobig.F (2003) The Sobig.F trojan infected an estimated 2 million PCs in 2003, grounding Air Canada flights and causing slowdowns across computer networks worldwide. This tricky bug-in-disguise cost $37.1 billion to clean up, making it one of the most expensive malware recovery efforts in history.

Image: Mike Cassese/Reuters/Corbis Skulls.A (2004) Skulls.A is a legitimately spooky mobile trojan that affected the Nokia 7610 smartphone and other SymbOS devices. The malware was designed to change all icons on infected phones to Jolly Rogers and disable all phone functions, save for making and receiving calls. F-Secure says Skulls.A caused little damage, but the trojan is undeniably creepy. Image: F-Secure Stuxnet (2009) Stuxnet is one of the first known viruses created for cyberwarfare . Created in a joint effort between Israel and the US, Stuxnet targeted nuclear enrichment systems in Iran. Infected computers instructed nuclear centrifuges to physically spin until they broke, all while providing fake feedback that operations were normal. Corbis MyDoom (2004) In April 2004, TechRepublic called MyDoom “the worst virus outbreak ever,” and it’s no surprise why. The worm increased the average page load time on the internet by 50%, blocked infected computers’ access to antivirus sites, and launched a denial-of-service attack on computing giant Microsoft.

The worldwide costs associated with cleanup of MyDoom is estimated to be just shy of $40 billion. Image: Imaginechina/Corbis Netsky (2004) The Netsky worm, created by the same teen who made Sasser , made its way around the world by way of email attachments. The P variant of Netsky was the most widespread worm in the world even more than two years after its February 2004 launch. Image: Carol & Mike Werner/Science Photo Library/Corbis Conficker (2008) The Conficker worm (aka Downup, Downadup, Kido), first detected in December 2008, was designed to disable infected computers’ antivirus programs and block autoupdates that may otherwise remove it from computers. Conficker quickly spread to numerous important computer networks, including those of the English, French, and German armed forces, causing $9 billion in damages.

Image: Andrew Kolb/Masterfile/Corbis The 18 scariest computer viruses of all time - Page 18 - TechRepublic The 18 scariest computer viruses of all time Previous Next Anna Kournikova (2001) The Anna Kournikova virus is so named because it tricked its recipients into thinking they were downloading a sexy picture of the tennis star. Financial damages associated with Kournikova were limited, but the virus had a big pop culture impact: It became a plot point in a 2002 episode of the sitcom Friends. For more IT nightmares, check out The 10 scariest cloud outages (and lessons learned from them) from our sister site ZDNet. Image: Brock Miller/Splash News/Corbis Sasser (2004) In April 2004, Microsoft issued a patch for a vulnerability in Windows’ Local Security Authority Subsystem Service (LSASS). Shortly after, a teenager in Germany released the Sasser worm to exploit the vulnerability in unpatched machines. Multiple variants of Sasser took out airline, public transportation, and hospital networks, causing $18 billion in damages.

Image: iStock Melissa (1999) Named after a Florida stripper, the Melissa virus was designed to propagate by sending itself to the first 50 contacts in its victims’ email Outlook address book. The attack was so successful that the virus infected 20% of the world’s computers, causing an estimated $80 million in damages. Virus creator David L. Smith was caught by the FBI, served 20 months in jail, and paid a $5,000 fine. Image: iStock Zeus (2009) While many malware programs on this list are little more than nuisances, Zeus (aka Zbot) was a tool used by a complex criminal enterprise. The trojan used phishing and keylogging to steal online banking credentials, draining a cumulative $70 million from the accounts of its victims. Image: iStock Storm Trojan (2007) Storm Trojan is a particularly sinister piece of email-distributed malware that accounted for 8% of all global infections just three days after its January 2007 launch.

The trojan created a massive botnet of between 1 and 10 million computers, and because it was designed to change its packing code every 10 minutes, Storm Trojan proved incredibly resilient . Image: 20th Century Fox ILOVEYOU (2000) The ILOVEYOU worm (aka Love Letter) disguised itself in email inboxes as a text file from an admirer. But this "love letter" was anything but sweet: In May 2000, it quickly spread to 10% of all internet-connected computers, leading the CIA to shut down its own email servers to prevent its further spread. Estimated damages were $15 billion. Image: iStock Sircam (2001) Like many early malware scripts, Sircam used social engineering to trick people into opening an email attachment. The worm chooses a random Microsoft Office file on victims’ computers, infects it, and sends it to all the people in the victims’ email contact list. A University of Florida study pegged Sircam cleanup costs at $3 billion.

Image: iStock Nimda (2001) Released just after the 9/11 attacks, many thought the devastating Nimda worm had an Al Qaeda connection, though that was never proven, and then-U.S. Attorney General John Ashcroft denied any correlation. It spread via multiple vectors, bringing down banking networks, federal courts, and other key computer systems. Cleanup costs for Nimda exceeded $500 million in the first few days alone. Michaelangelo (1992) The Michelangelo virus spread to relatively few computers and caused little real damage. But the concept of a computer virus set to "detonate" on March 6, 1992 caused a media-fueled mass hysteria, with many afraid to operate their PCs even on anniversaries of the date. SQL Slammer/Sapphire (2003) Taking up just 376 bytes, the SQL Slammer worm packed a lot of destruction into a tiny package. The worm slowed down the internet, disabled 911 call centers, took down 12,000 Bank of America ATMs, and caused much of South Korea to go offline.

It also crashed the network at Ohio’s Davis-Besse nuclear power plant. Image: iStock Code Red (2001) The Code Red worm , named after the Mountain Dew flavor preferred by its creators, infected up to one-third of all Microsoft ISS web servers upon release. It even took down whitehouse.gov, replacing its homepage with a “Hacked by Chinese!” message. Estimated damages due to Code Red were in the billions of dollars worldwide. Cryptolocker (2014) Computers infected with Cryptolocker have important files on their hard drives encrypted and held at ransom . Those who pay approximately $300 in bitcoin to the hackers are given access to the encryption key; those who fail to pay have their data deleted forever. Sobig.F (2003) The Sobig.F trojan infected an estimated 2 million PCs in 2003, grounding Air Canada flights and causing slowdowns across computer networks worldwide. This tricky bug-in-disguise cost $37.1 billion to clean up, making it one of the most expensive malware recovery efforts in history.

Image: Mike Cassese/Reuters/Corbis Skulls.A (2004) Skulls.A is a legitimately spooky mobile trojan that affected the Nokia 7610 smartphone and other SymbOS devices. The malware was designed to change all icons on infected phones to Jolly Rogers and disable all phone functions, save for making and receiving calls. F-Secure says Skulls.A caused little damage, but the trojan is undeniably creepy. Image: F-Secure Stuxnet (2009) Stuxnet is one of the first known viruses created for cyberwarfare . Created in a joint effort between Israel and the US, Stuxnet targeted nuclear enrichment systems in Iran. Infected computers instructed nuclear centrifuges to physically spin until they broke, all while providing fake feedback that operations were normal. Corbis MyDoom (2004) In April 2004, TechRepublic called MyDoom “the worst virus outbreak ever,” and it’s no surprise why. The worm increased the average page load time on the internet by 50%, blocked infected computers’ access to antivirus sites, and launched a denial-of-service attack on computing giant Microsoft.

The worldwide costs associated with cleanup of MyDoom is estimated to be just shy of $40 billion. Image: Imaginechina/Corbis Netsky (2004) The Netsky worm, created by the same teen who made Sasser , made its way around the world by way of email attachments. The P variant of Netsky was the most widespread worm in the world even more than two years after its February 2004 launch. Image: Carol & Mike Werner/Science Photo Library/Corbis Conficker (2008) The Conficker worm (aka Downup, Downadup, Kido), first detected in December 2008, was designed to disable infected computers’ antivirus programs and block autoupdates that may otherwise remove it from computers. Conficker quickly spread to numerous important computer networks, including those of the English, French, and German armed forces, causing $9 billion in damages. Image: Andrew Kolb/Masterfile/Corbis CNN.com - Technology - Security experts: Virus proves systems still vulnerable - February 19, 2001 Security experts: Virus proves systems still vulnerable From...

by Jennifer DiSabatino (IDG) -- Security software vendors and other experts have been warning users of the dire consequences posed by e-mail viruses, such as the worm disguised as a photo of Russian tennis star Anna Kournikova that was launched last week. Servers across corporate America were bombarded last Monday with the Visual Basic Script (VBS) worm built from a crude tool kit (see "Computer virus poses as image of tennis star Anna Kournikova," link below). That the Kournikova worm spread as swiftly as it did proves that companies have a long way to go to improve lax security in their infrastructure and among their users, according to security managers and analysts. ALSO Security on the Net "I didn't see anything new about this one. People should have had filters in place to prevent this," said Mark Amos, manager of information security at Owens Corning in Toledo, Ohio. The worm was allegedly written by a 20-year-old Dutch man who goes by the handle "OnTheFly." The unidentified suspect turned himself in to police in the Dutch province of Friesland yesterday (see "Suspected 'Anna' virus writer turns himself in to Dutch police," link below).

In his statement to the authorities, the suspect said that he "made a virus to prove how simple it was to make [one] and how vulnerable computers are for viruses." IDG.net INFOCENTER Visit an IDG site IDG.net search This time, users were relatively lucky because the worm didn't damage their computers. But the virus did widely replicate itself: Once the attachment was opened, the worm worked its way through every e-mail address in the address books of Microsoft Outlook users. Yet, eight months ago, Microsoft Corp. put out a patch for its Outlook e-mail software in response to similar problems with the more damaging "I Love You" virus last year. That patch would have prevented users from being infected with the Kournikova worm, analysts said. While those hardest hit aren't talking about the virus and its damage to their corporate systems, a few security managers have shared their experiences with the Kournikova worm, or VBS/SST. The easiest way to avoid being infected was to not open the attachment. But despite hard lessons from the "I Love You" and Melissa viruses, many users chose to double-click the infected attachment for the promise of a photo of the tennis pro and model. Paul L.

Schmehl, supervisor of support services at the University of Texas at Dallas, said constant education of his staffers has led them to a point where he trusts them to recognize the potential threat in unsolicited attachments. "Our experience has shown that our users do use sound judgment regarding attachments," he said. "However, the onslaught of viruses that use stealth, encryption, multiple attachment file names, subject lines and body text makes it more hassle than it's worth to keep our users informed of the details of every virus. So we now bounce them at the gateway mail server, and they never enter our environment to begin with." Amos deploys similar multiple lines of defense. "We hadn't had any reports of infections," he said. "[But], we did filter a lot of that stuff. We had around 500 .vbs hits [Tuesday]." Part of the filtering includes antivirus software that scans for infected files, but other filtering devices also block extensions, such as .exe and .vbs, that commonly contain viruses. Owens Corning uses several layers of security that keep end users from even seeing most attachments, Amos said.

The company uses an external filter service outside the firewall, antivirus software at the firewall, filters internally between servers and on the antivirus software on the desktops, Amos said. Users, with limited exceptions, can't receive attachments, he said. While it may seem draconian, the company's strict e-mail usage policy prohibits personal e-mails, he noted, and "people are unlikely to complain that, 'Gee I didn't get my valentine,' when they know they are only supposed to use e-mail for business purposes." All that effort seems to have done the trick with the Kournikova virus, according to Amos. "We didn't have any problem at all," he said. Gary Mattson, network security manager at San Francisco-based Catholic Healthcare West, said the external protection he had last week, compared with the partial lack of it when the Melissa virus hit in March 1999, proved that there's a lot to be said for gateway protection. Like Amos, Mattson has layers of filters. First, his e-mail goes through the Message Monitoring Server Network from Tumbleweed Communications Corp. in Redwood City, Calif. Though the software isn't primarily there to catch viruses, it has that side effect.

Then, Mattson said, his servers clean out infected attachments with Groupshield 4.5 antivirus software from Network Associates Inc. But Mattson said software alone won't provide adequate protection. Staffing is also a must. "You can't just put it up there and walk away and not staff it," he said. "We have patient data that we want to ensure stays confidential." Blocking suspect attachments is no silver bullet either, said Matthew Pemble, a consultant at the Preston Technology Management Centre in Lancashire, U.K. Virus writers can rename a Microsoft Word file, for example, as a rich text file. While rich text can't hold viral macros, Word documents can, and an otherwise savvy user may unwittingly open a virus in what he thought was a safe file type. "This is not to say that blocking by extension is bad -- it is a massive damage limiter -- just that it is not enough," Pemble said. "Scan everything at the gateway, scan everything at the desktop [preferably using different tools.] And then expect to get hit once in a while, anyway." RELATED STORIES: 'I Love You' virus sweeps the U.S.

- May 5, 2000 May 5, 2000: 11:33 p.m. ET Quickly spreading virus disables multimedia files, spawns copycats By Staff Writers David Kleinbard and Richard Richtmyer NEW YORK (CNNfn) - The newly discovered "I Love You" virus that swept through banks, securities firms, and Web companies in the United States Thursday and later spawned copycat viruses has proved in large part to be more of an annoyance than a costly disruption of business. The virus did cause damage, however, at companies that make heavy use of multimedia files, such as magazines and advertising agencies, because it overwrites picture files with "jpg" extensions and MP3 music files. VIDEO The "Love Bug" bit the computer world hard on Thursday in the latest sign of how vulnerable the global infrastructure is to easy-to-launch and hard-to-detect hacker attacks. Real 80K In addition, the virus could result in some security breaches weeks or months from now because it can steal network passwords from a computer and send them to a remote location, security experts said.

McAfee.com ( MCAF : Research , Estimates ), makers of the best-selling VirusScan security software, said that 60 to 80 percent of its Fortune 100 clients were infected by the virus. McAfee released a software patch that can identify the virus Thursday afternoon. As corporate employees headed home Thursday, network administrators scrambling to contain the virus were also battling copycat attacks, including one dubbed "very funny."� The new variants can elude anti-virus software designed to block the I Love You bug and could potentially cause the same damage. Dozens more copycat attacks are expected, security experts said. The I Love You virus spreads quickly among users of Microsoft Outlook and corporate networks that use the Microsoft Exchange e-mail server because it sends a copy of itself to every e-mail address in a recipient's Outlook address book. By contrast, the "Melissa" virus, which spread around the globe in March 1999 , sent itself only to the first 50 people on a victim's address book.

Click here to read CNN.com's full coverage of the I Love You computer virus story "Its transmission technique is somewhat similar to Melissa," said Chris Rouland, director of the X-Force security research team at Internet Security Systems ( ISS X: Research , Estimates ) in Atlanta. "Once launched, it downloads an executable backdoor program from one of four Web sites. That program, Win-Bugsfix, steals passwords stored on that computer and sends them to an e-mail address in the Philippines." If a person whose computer has been infected with I Love You uses the popular Internet chat program mIRC, the virus will attempt to transmit itself to every user who enters the chat room, Rouland said. Rob Clyde, vice president of security management at Axent Technologies �( AXNT : Research , Estimates ) in Rockville, Md., said that the virus tries to connect to one of four Web sites, but that those sites were down today. "In theory, it could allow the people who own those sites to get access to your computer, but there is no indication that the virus has ever been successful at connecting to those sites," Clyde said. "A lot of companies shut off their e-mail systems to contain the virus, which caused disruption," Clyde said.

Business as usual at investment banks All the major commercial and investment banks contacted by CNNfn.com Thursday reported having individual computers infected with I Love You. However, none said that trading activities were disrupted because of it. "The virus was not debilitating at all - it was more of a nuisance or annoyance than anything," said Russell Sherman, a spokesman for Bear Stearns in New York. "We isolated the servers that were affected." "It had no impact on applications or client business," said PaineWebber spokesman Paul Marrone. "We learned of the virus early this morning, notified all employees, and are in the process of cleaning it up."� ISP's say customer accounts still working Internet service providers also reported that I Love You had a minimal impact on their business and their customers. They also pointed out that corporate e-mail systems appear to be more vulnerable to the virus than most home e-mail users because of the widespread use of Microsoft's Outlook and Exchange products. "We're still doing a fair amount of scrambling to find out exactly what the impact is, but so far it has not affected the mail delivery to our members," said Steve Dougherty, director of technology acquisition at Earthlink ( ELNK : Research , Estimates ), the second-largest U.S. Internet service provider.

"Earthlink service has been available full time," Dougherty added. "And the volume of traffic on our mail servers is not appreciably different than normal." Competing Internet service provider Concentric Network also reported that the company and its customers were not seriously hurt by I Love You. The number of e-mail messages containing the virus on Concentric's customer e-mail servers was minimal, according to David Schairer, the company's chief systems architect. "Out of about 5,000 messages that I scanned, I saw 17 virus traces. That's much lower than I would have expected," Schairer said. However, the virus caused some internal problems at Concentric's corporate offices. "We saw a little bit of it, and our security people went right to work on it," Schairer said. "When you have 1,000 or more people, there will always be some who have their mail clients configured to allow these things through." Even so, Schairer warned that since the virus was developed using a programming language that is easy to understand, further attacks are likely. "This is going to get worse before it gets better," he said. "The code is very easy to read, and there will be copycats.

Every teenager who understands a bit of Visual Basic can download this thing now, do their own thing with it, then distribute it again." Customers at America Online, the largest U.S. Internet service provider, have been relatively unaffected, although the company is taking steps to alert them of the virus, said spokesman Rich D'Amato. AOL has its own proprietary e-mail program, which has been unaffected by the virus, D'Amato said. AOL has a pending merger agreement with Time Warner, the owner of CNNfn. Amazon.com spokesman Bill Curry said that he was unaware of any problems created by the virus at the online retailing giant. Likewise, a spokesman for the online auction site eBay said the site is "operating at full strength." Security of Microsoft Outlook questioned Technology experts blamed the rapid proliferation of the virus on Microsoft putting usability ahead of security in the design of its products. "Microsoft could have done things to make its products more secure, but Microsoft is in the business of making everybody's life easier," said Steve Fallin, director of the rapid response team for Seattle-based Internet security firm WatchGuard Technologies.

"Microsoft has been kind of lax with their security posture," said Michael Zboray, chief technology officer for Stamford, Conn.-based consultant Gartner Group. While admitting that Outlook was targeted for its reach, Microsoft security manager Scott Culp said the effectiveness of the I Love You virus was not due to a design flaw in Outlook and that the program has built-in features to increase security. - Reuters contributed to this report. RELATED SITES

Question: Anna Kournikova, Michelangelo, ILOVEYOU, and Melissa were examples of what?
Answer: Computer virus