First Antivirus Software Ever Built
In this post
Every computer today carries a guard. It watches downloads, scans files, and quietly removes threats before they can do harm, and most people never think about it. But the guard was not there at the start. The first computer viruses arrived before anyone had built a defence against them, and the story of the first antivirus is really the story of a chase: each new mischief forced someone to invent a new kind of protection, and the protection then forced the mischief to grow smarter.
The chase began with an idea, decades before the first real virus. In 1966, the mathematician John von Neumann described self-reproducing automata — programs that could copy themselves — as a theoretical curiosity. Nobody called it a virus then, and nobody feared it. It was mathematics, not menace. Five years later, the theory escaped into the real world, and computing has been playing catch-up ever since.
Creeper: the worm that started it all
In 1971, Bob Thomas, a researcher at the company BBN, created a program called Creeper. Creeper was not built to steal or destroy. It was an experiment, and it moved across the early ARPANET network — the ancestor of the internet — from computer to computer, displaying a teasing message: “I’M THE CREEPER: CATCH ME IF YOU CAN.” It copied itself as it went, which made it a worm, a self-spreading program, and the first of its kind in the wild.
Creeper did no damage, but it proved something important: a program could travel between machines on its own, without anyone carrying it. That proof changed computing. A curiosity had become a capability, and capabilities get used by everyone, including people with worse intentions than a researcher showing off a clever trick.
The details come from AVG’s history of computer viruses, which traces the line from von Neumann’s idea through Creeper and beyond. The history matters because it shows the pattern that repeats for the next fifty years: a new kind of program appears, people realise what it can do, and defenders scramble to answer it.
Reaper: the first hunter
The answer to Creeper came from the same world that made it. Ray Tomlinson, another BBN researcher, built a version of Creeper that could copy itself, and then built Reaper, a program whose only job was to chase Creeper across the network and delete it. Reaper is often called the first antivirus, because it was the first program written to find and remove malicious self-copying software.
Reaper was simple by modern standards. It did not scan for thousands of threats or watch behaviour in real time. It knew one enemy, and it hunted that enemy. But the idea inside it — a program that defends computers against other programs — is the idea inside every antivirus today. The guard on your computer is Reaper’s descendant, grown enormous.
There is a pleasing symmetry in the story. The first virus and the first antivirus were born in the same place, in the same years, from the same curiosity. Attack and defence entered computing together, and they have never left each other’s side since.
Elk Cloner: the prank that spread by floppy disk
For a decade, viruses stayed mostly in laboratories and research networks. Then, in 1982, a fifteen-year-old school student named Rich Skrenta wrote Elk Cloner for the Apple II computer. Elk Cloner spread on floppy disks: every fiftieth time an infected disk was used to start the computer, it displayed a short poem instead of loading normally. It was a prank, not a crime, and it spread through schools because friends shared disks.
Elk Cloner matters because it showed that viruses did not need a network. They could travel the way people shared things — hand to hand, disk to disk — and reach ordinary users who had never heard of ARPANET. The audience for viruses had grown from researchers to schoolchildren, and the need for protection had grown with it.
The poem itself was harmless, but the mechanism was the lesson. A program that hides on a disk, copies itself to every new disk, and waits for a trigger is a virus in the full sense, and Elk Cloner was one of the first to reach the public in that form. From here on, viruses were no longer a laboratory curiosity. They were a fact of everyday computing.
The word virus is born
In 1983, a researcher named Fred Cohen gave the phenomenon its lasting name. Cohen used the term “computer virus” to describe a program that could copy itself into other programs, and he demonstrated the idea in academic work that treated self-reproducing programs seriously for the first time. The name stuck because the analogy was exact: like a biological virus, a computer virus needs a host, copies itself inside it, and spreads to new hosts.
Naming the thing changed how people thought about it. A “prank program” sounds like a joke. A “virus” sounds like something to defend against, and defence needs tools, rules, and eventually an industry. Cohen’s word arrived just as personal computers were spreading into homes and offices, which meant the timing could hardly have mattered more.
By the mid-1980s, the pieces were all in place: self-copying programs, a public that shared disks freely, and a name that made the danger easy to understand. What was missing was a commercial answer — protection ordinary people could buy and install.
Brain: the virus with an address
In 1986, two brothers in Lahore, Pakistan — Basit and Amjad Alvi — created a virus called Brain. The brothers ran a computer shop, and they were frustrated that people copied their software without paying. Brain was their answer: it infected the boot sector of floppy disks, slowed the machine, and carried the brothers’ names, address, and phone number inside its code. It was, in its own way, an anti-piracy message that copied itself.
Brain spread far beyond Pakistan, carried by shared disks around the world, and it showed that viruses now came from everywhere, not only from research labs in America. It also showed something stranger: the first widely spread virus for the IBM PC was built by businessmen defending their work, not by criminals. Motives in the virus world were already complicated, and they have stayed complicated.
The Alvi brothers later said they had not meant Brain to spread so widely. Intentions hardly mattered. The mechanism was loose in the world, and every disk that carried it taught more people that their computers could be infected by something they could not see.
The first dedicated antivirus of 1987
The late 1980s brought the Vienna virus, which damaged files on infected computers, and the damage finally produced a dedicated answer. According to AVG’s history, the first dedicated antivirus software was built in 1987 specifically to fight the Vienna virus. Unlike Reaper, which hunted one worm, this was a tool built for the job of defence itself: find the virus, remove it, and protect the machine.
The exact details of that first tool are less important than what it represented. Antivirus had become a product, not a one-off experiment. Someone could buy protection, install it, and expect it to guard the machine against threats they had never heard of. The industry that now protects billions of devices began with that shift: from clever researchers chasing one worm, to a standing guard built for a world full of them.
The years that followed proved the need. In 1989, the AIDS Trojan arrived — the first ransomware — hiding on floppy disks sent to an AIDS conference mailing list and demanding payment. In 1992, the Michelangelo virus, set to trigger on the artist’s birthday, caused a wave of public panic, with warnings far outrunning the actual damage. Each scare grew the antivirus industry, and each new virus taught it a new trick.
From one hunter to an industry
Modern antivirus software descends directly from Reaper and the 1987 tool, but it works in ways those pioneers would barely recognise. Today’s guards scan files against huge lists of known threats, watch programs for suspicious behaviour, check downloads before they run, and update themselves constantly as new threats appear. The chase that started with one worm and one hunter now involves thousands of new malicious programs every day, and defences that learn and adapt.
Yet the core idea has never changed. A program watches for other programs behaving badly, and removes them before they can harm the machine or its owner. The names changed — antivirus became endpoint protection, then cybersecurity platforms — but the job is Reaper’s job: catch the creeper, if you can.
The history also carries a warning. Every defence in this story was built after the attack it answered. Creeper came first, Reaper second. Viruses came first, dedicated antivirus second. Ransomware came first, and defences against it are still catching up. The safest computer is not the one with the newest guard. It is the one whose owner updates the guard, thinks before opening attachments, and remembers that the chase never ends.
The Michelangelo scare and the antivirus boom
The antivirus industry grew fastest when fear outran fact. In 1989, the AIDS Trojan arrived on floppy disks sent to an AIDS conference mailing list, demanding payment to restore files — the first ransomware, arriving years before the word existed. In 1992, the Michelangelo virus, programmed to trigger on the artist’s birthday, 6 March, caused a wave of public panic, with warnings far outrunning the actual damage. The panic sold antivirus software by the box, and it taught the industry its most durable lesson: fear moves faster than viruses, and a public that is frightened buys protection. The honest antivirus makers learned to warn without panicking, because a panic that passes leaves a public that stops listening, and the next real threat needs listeners.
Frequently Asked Questions
What was the first antivirus software?
The first program built to hunt a virus was Reaper, written by Ray Tomlinson in the early 1970s to chase and delete the Creeper worm across the ARPANET. The first dedicated antivirus software as a product was built in 1987 to fight the Vienna virus. Reaper was the first hunter, while the 1987 tool was the first standing guard built specifically for defence.
What was the first computer virus?
The first self-spreading program in the wild was Creeper, created in 1971 by Bob Thomas at BBN, which moved across the early ARPANET displaying the message “I’M THE CREEPER: CATCH ME IF YOU CAN.” The first virus to reach ordinary users on personal computers was Elk Cloner, written in 1982 by fifteen-year-old Rich Skrenta for the Apple II, which spread on floppy disks and showed a poem every fiftieth boot.
Who invented the term computer virus?
The researcher Fred Cohen coined the term “computer virus” in 1983, using it to describe a program that could copy itself into other programs. The name stuck because the analogy was exact: like a biological virus, a computer virus needs a host, copies itself inside it, and spreads to new hosts. The naming helped people take self-copying programs seriously as a danger to defend against.
What was the Brain virus and where did it come from?
Brain was created in 1986 by Basit and Amjad Alvi, two brothers in Lahore, Pakistan, who ran a computer shop and wanted to stop people copying their software without paying. It infected the boot sector of floppy disks and carried the brothers’ names, address, and phone number in its code. Brain spread worldwide on shared disks and was the first widely spread virus for the IBM PC.
How did antivirus software change after 1987?
After the first dedicated antivirus tool of 1987, the industry grew with every new threat, from the AIDS Trojan ransomware of 1989 to the Michelangelo panic of 1992. Modern antivirus scans files against huge lists of known threats, watches programs for suspicious behaviour, and updates constantly. The core idea is unchanged from Reaper: a program that finds and removes programs behaving badly before they can harm the machine.
Sources
- AVG — History of Computer Viruses (fetched 2026-10-28)
