Top 15 Worst Computer Viruses of All Time: Quick List

Last Updated on October 29, 2026 by Editorial

The worst computer viruses in history have done far more than slow down computers or delete files. Some spread to millions of devices within hours, while others disrupted hospitals, stole banking credentials, or destroyed critical business data.

Their impact changed how people use computers and how organizations approach cybersecurity.

Many of these attacks succeeded because of simple mistakes, such as opening a suspicious email attachment or failing to install a security update. Others exploited vulnerabilities that allowed them to spread automatically across networks.

Looking at the worst computer viruses of all time reveals how malware has evolved and why some attacks remain important lessons for anyone who uses a computer.

What Is a Computer Virus?

A computer virus is a type of malicious software that attaches itself to a legitimate file or program and spreads when that host executes. Depending on its design, a virus may corrupt files, steal information, interfere with system operations, or deliver other malicious code.

However, people often use the term computer virus to describe malware in general. Worms can spread between computers without attaching themselves to another program.

Trojans disguise malicious functionality as legitimate software, while ransomware encrypts files or otherwise blocks access to data until attackers demand payment.

These distinctions matter when discussing the worst computer viruses. Several of the most destructive attacks in history were technically worms, Trojans, or other forms of malware rather than traditional viruses.

How We Ranked the Worst Computer Viruses

This list considers several factors:

• The scale of infection
• Estimated financial losses
• Severity of the damage
• Disruption to essential services
• Lasting influence each attack had on cybersecurity

The order is not a definitive scientific ranking. Historical damage estimates often differ between sources, and some outbreaks caused widespread disruption without leaving reliable figures for the total number of victims. The goal is to highlight 15 malware attacks that left a significant mark on computing history.

15 Worst Computer Viruses of All Time

1. MyDoom (2004)

MyDoom emerged in January 2004 and quickly became one of the fastest-spreading email worms ever recorded. It arrived in malicious email attachments and relied on recipients opening them to infect their computers.

Once active, MyDoom collected email addresses and sent copies of itself to other potential victims. Some versions also opened backdoor access, allowing attackers to communicate with infected systems.

The worm was associated with denial-of-service attacks against websites, including those belonging to the SCO Group.

MyDoom spread so rapidly that security researchers detected millions of copies circulating across numerous countries within days. Frequently cited estimates place its economic damage in the tens of billions of dollars, although these figures are not precise accounting totals.

Its success demonstrated how email could become a distribution network for malicious software. Even years later, MyDoom variants continued to appear, showing how long malware can persist after its initial outbreak.

2. Sobig.F (2003)

Sobig.F was one of the most disruptive variants of the Sobig worm family. It spread through email attachments that appeared to contain ordinary files or messages. When recipients opened an infected attachment, the worm collected email addresses and sent copies to other people.

The resulting traffic overwhelmed email systems and consumed network resources. Businesses and other organizations had to contend with large volumes of malicious messages while trying to maintain normal operations.

Sobig.F also used infected computers to receive instructions from remote servers, demonstrating how malware could turn ordinary machines into part of a coordinated operation.

The outbreak helped expose the weaknesses of early email security systems. It also showed that an attack does not need to destroy files to cause serious damage. Overloading communication systems can interrupt work, delay services, and create substantial recovery costs.

3. ILOVEYOU (2000)

ILOVEYOU, also known as the Love Bug, became one of the most famous malware outbreaks in history after appearing in May 2000. It arrived in an email with the subject line “ILOVEYOU” and an attachment disguised as a love letter.

The message appealed to recipients’ curiosity and emotions. Opening the attachment executed a malicious Visual Basic script that modified or overwrote certain files, searched for stored information, and sent copies of the message to contacts through Microsoft Outlook.

The worm spread rapidly through homes, businesses, and government organizations. Contemporary and later accounts have reported tens of millions of affected computers, although exact counts vary. Commonly cited damage estimates reach several billion dollars.

ILOVEYOU remains a defining example of social engineering: attackers exploit human behavior rather than relying entirely on technical vulnerabilities.

Its enduring lesson is straightforward. An attachment can appear personal, familiar, or harmless while still carrying malicious code. People should verify unexpected files, even when a message appears to come from someone they know.

4. Conficker (2008)

Conficker emerged in 2008 and exploited a vulnerability in Microsoft Windows to spread across vulnerable computers. It also used other techniques, including weak administrator passwords and removable media, to reach additional systems.

After infecting a machine, Conficker could disable certain security services, interfere with updates, and connect to infrastructure controlled by its operators. Its ability to generate changing domain names made it difficult for defenders to block all its potential command-and-control connections.

The worm infected computers across many countries and affected organizations that struggled to patch vulnerable systems. Estimates of its peak size vary, with some historical assessments placing the number of infected machines in the millions.

Conficker was particularly concerning because infected computers could remain compromised even after the initial outbreak subsided. It demonstrated that a single vulnerability, combined with poor patch management and weak passwords, could expose enormous numbers of devices.

The incident reinforced the need to install security updates promptly, use strong credentials, and monitor networks for suspicious activity.

5. WannaCry (2017)

WannaCry became one of the most consequential malware outbreaks of 2017. It combined ransomware with worm-like spreading capabilities, allowing it to move rapidly between vulnerable Windows computers.

The malware exploited a Windows vulnerability associated with the Server Message Block protocol. Although Microsoft had released a security update before the outbreak, many systems remained unpatched.

Once installed, WannaCry encrypted files and displayed a ransom demand. Its automatic propagation meant that one vulnerable computer could help spread the infection across a larger network.

The attack affected organizations in more than 150 countries. Britain’s National Health Service suffered significant disruption, with some appointments and operations cancelled as healthcare providers dealt with infected systems.

The outbreak also highlighted the risks of operating unsupported software and postponing security updates. Paying a ransom is not a reliable way to recover files, so organizations need tested backups and incident response plans.

WannaCry remains one of the clearest examples of how an unpatched vulnerability can turn a local infection into a worldwide crisis.

6. Zeus (2007)

Zeus was a notorious banking Trojan designed to steal sensitive information from infected computers. Unlike a traditional computer virus, it did not depend on attaching itself to other programs to reproduce.

Cybercriminals distributed Zeus through malicious downloads, phishing emails, and compromised websites. Once installed, it could monitor user activity and capture information entered into online banking sessions.

The stolen credentials allowed criminals to access victims’ financial accounts and attempt unauthorized transactions. Zeus also became part of a broader criminal ecosystem in which malware, stolen credentials, and compromised computers could be traded or reused.

The malware family evolved through multiple variants and inspired other banking Trojans. Its influence extended beyond individual infections because it demonstrated how malware could support organized, financially motivated crime.

Zeus is an important reminder that malware does not always announce itself by damaging files or slowing down a computer. Some threats operate quietly while collecting information that attackers can use to steal money or identities.

7. Code Red (2001)

Code Red appeared in July 2001 and targeted a vulnerability in Microsoft’s Internet Information Services web server software.

Unlike email worms that depended on people opening attachments, Code Red could spread by scanning for vulnerable servers and exploiting them automatically. This allowed it to infect large numbers of systems in a short period.

Some infected servers were instructed to launch denial-of-service attacks against targeted websites. The worm also defaced certain websites by replacing their normal content with a political message.

Code Red showed that servers connected directly to the internet could become powerful vehicles for malware propagation. A compromised server could affect its owner while also being used to attack other systems.

The outbreak emphasized the importance of patching internet-facing software and limiting unnecessary services. It also demonstrated that an organization can become part of a larger attack without deliberately participating in it.

8. SQL Slammer (2003)

SQL Slammer, also known as the Sapphire worm, emerged in January 2003. It exploited a vulnerability in Microsoft SQL Server and related database software.

The worm was exceptionally small, but it spread at remarkable speed. It generated large volumes of traffic as infected machines scanned for additional vulnerable systems, creating network congestion and disrupting services.

Some banks, businesses, and other organizations experienced outages. The incident also affected parts of the internet infrastructure, demonstrating how a rapidly spreading worm could produce consequences far beyond its initial victims.

SQL Slammer did not need to delete files or demand a ransom to cause damage. Its rapid propagation and network traffic were enough to disrupt systems.

The outbreak remains a major case study in the relationship between software vulnerabilities and internet-wide disruption. It also illustrates why organizations should patch exposed services, segment networks, and prepare for sudden increases in malicious traffic.

9. Stuxnet (2010)

Stuxnet was a sophisticated malware operation discovered in 2010. Unlike many of the worst computer viruses, which focused on stealing information or spreading widely, Stuxnet targeted industrial control systems.

It used multiple Windows vulnerabilities and could spread through removable media and other routes. Its most distinctive feature was its ability to interact with specific industrial software and manipulate programmable logic controllers.

Stuxnet was designed to interfere with equipment associated with Iran’s nuclear program. Reports linked the attack to damage involving centrifuges used in uranium enrichment.

The malware attracted international attention because it demonstrated that malicious code could cause physical consequences. Computers were no longer merely tools for storing information or communicating; they could also control machinery and industrial processes.

Stuxnet changed how security professionals viewed threats to critical infrastructure. It highlighted the importance of isolating sensitive industrial networks, controlling removable media, monitoring system changes, and treating operational technology as a distinct security priority.

10. Sasser (2004)

Sasser spread through a vulnerability in the Windows Local Security Authority Subsystem Service. Unlike many email worms of the period, it could infect vulnerable computers without requiring users to open an attachment.

Once active, Sasser scanned for other vulnerable systems and attempted to exploit them. Infected computers could become unstable, repeatedly restart, or experience problems that prevented users from working normally.

The outbreak disrupted organizations in several countries. Reports from the period described interruptions affecting airlines, financial services, and other businesses.

Sasser illustrated how an internet-connected computer could become infected simply because it was running vulnerable software exposed to the network.

Its lesson was particularly important for organizations with large numbers of computers. A single unpatched vulnerability could spread through an environment and cause operational problems across multiple departments.

Regular patching, network monitoring, and limiting unnecessary exposure can help prevent similar outbreaks.

11. Melissa (1999)

Melissa emerged in March 1999 and became one of the best-known early examples of malware spreading through office documents.

The virus was distributed through a Word document that promised access to adult website passwords. When a recipient opened the document with a compatible version of Microsoft Word, its malicious macro code executed.

Melissa then used Microsoft Outlook to send infected documents to the first 50 contacts in the victim’s address book. As more people opened the attachment, the number of infected systems and outgoing messages increased.

The sudden flood of email overwhelmed mail servers at numerous organizations, forcing some to temporarily restrict or shut down email services.

The FBI reported that the cleanup and repair costs were estimated at around $80 million, although historical damage figures should be understood as estimates rather than precise totals.

Melissa demonstrated that legitimate productivity software could become a vehicle for malware. It also showed why organizations need to control macro execution, filter suspicious attachments, and educate employees about unexpected files.

12. CryptoLocker (2013)

CryptoLocker became notorious in 2013 for encrypting victims’ files and demanding payment in exchange for a decryption key.

It was commonly distributed through malicious email attachments and other malware delivery methods. Once running, CryptoLocker used strong encryption to make files inaccessible without the required key.

Victims were presented with a ransom demand and a deadline. Losing access to business documents, photographs, and other important files created pressure to pay, even though payment did not guarantee successful recovery.

CryptoLocker helped popularize the modern ransomware business model, in which criminals use encryption to turn access to data into a source of income.

A major law enforcement operation disrupted the infrastructure associated with the malware in 2014, and recovery tools were subsequently made available to many victims.

CryptoLocker remains an important example of why backups should be maintained separately from everyday systems. A reliable, tested backup can allow victims to restore files without depending on a criminal’s promise.

13. Morris Worm (1988)

The Morris worm appeared on November 2, 1988, when much of the internet consisted of university, research, and government-connected systems.

Created by Cornell graduate student Robert Tappan Morris, the worm was intended to measure the size of the internet. However, a flaw in its replication behavior caused it to reinfect computers repeatedly, consuming resources until many systems became unusable.

The worm exploited weaknesses in Unix systems and used several methods to spread between connected computers. Within 24 hours, an estimated 6,000 of the roughly 60,000 computers then connected to the internet had been affected, according to the FBI.

Although the worm was not designed to cause the same kind of deliberate destruction associated with modern ransomware, its unintended consequences were severe.

The incident became a turning point in computer security. It demonstrated how quickly self-replicating software could overwhelm interconnected systems and helped drive the development of more formal incident response capabilities.

The Morris worm also established an enduring lesson: even software created for experimentation can cause major harm when safeguards fail.

14. Nimda (2001)

Nimda appeared in September 2001 and spread through several routes, making it particularly difficult to contain.

It could propagate through email, exploit vulnerable web servers, search for network shares, and use files left behind by earlier infections. This combination allowed it to reach systems through different weaknesses rather than relying on a single delivery method.

Once inside a network, Nimda could consume resources, modify files, and create additional security problems. Its ability to exploit multiple paths helped it spread quickly across the internet.

The outbreak showed why protecting only one entry point is insufficient. Blocking suspicious email attachments, for example, would not stop a worm that could also exploit a vulnerable server.

Nimda reinforced the need for layered security. Organizations need current software, endpoint protection, access controls, network segmentation, and monitoring that can detect suspicious activity across different systems.

Its multi-vector approach remains relevant because modern attackers also combine phishing, stolen credentials, software vulnerabilities, and lateral movement to reach their targets.

15. NotPetya (2017)

NotPetya emerged in June 2017 and initially resembled ransomware. In reality, its primary purpose was destructive: it damaged data and disk structures in ways that prevented normal recovery.

According to MITRE ATT&CK, the malware used worm-like capabilities to spread across Windows networks. It exploited vulnerabilities in the Server Message Block protocol and used other techniques to move between systems.

The outbreak began through a compromised software update mechanism associated with a Ukrainian accounting program. From there, it spread beyond its initial targets and affected international organizations.

Businesses experienced widespread outages, lost access to critical systems, and faced extensive recovery work. The financial impact ran into billions of dollars, although reported estimates differ.

NotPetya is particularly important because it exposed the limits of treating every ransom demand as a genuine offer to restore data. Unlike ordinary ransomware, its destructive design meant victims could not simply pay to regain access to their files.

The incident highlighted the importance of offline backups, software supply chain security, network segmentation, and tested disaster recovery procedures.

Comparison of the Worst Computer Viruses

The table below summarizes the 15 malware incidents and the main reason each became significant. Financial losses are not ranked because historical estimates are inconsistent and do not measure every kind of damage equally.

How to Protect Your Computer From Viruses and Malware

The worst computer viruses often succeeded because systems were vulnerable, users trusted deceptive messages, or organizations lacked effective recovery plans. You can reduce the risk of a similar incident by following several basic security practices.

1. Keep your operating system and applications updated

Install security updates as soon as practical. WannaCry, Conficker, Sasser, and SQL Slammer demonstrate how attackers can exploit known vulnerabilities in systems that have not been patched.

Enable automatic updates where appropriate, and replace operating systems that no longer receive security support.

2. Use reputable antivirus software

Modern security software can detect many malicious files, suspicious behavior, and known malware. Keep its protection mechanisms updated and run regular scans.

Antivirus software is not a guarantee against every threat, especially new or targeted attacks. Combine it with updates, safe browsing, and appropriate access controls.

3. Treat unexpected attachments with caution

ILOVEYOU and Melissa spread partly because recipients trusted messages and opened their attachments.

Be suspicious of unexpected files, particularly executable files, scripts, archives, and documents that ask you to enable macros. Verify unusual requests through another communication channel before opening attachments.

4. Back up important files

Ransomware such as WannaCry and CryptoLocker can make files inaccessible, while NotPetya can destroy the data required for recovery.

Keep regular backups on a separate device or protected service. Maintain at least one backup that malware running on your computer cannot modify or delete, and test the recovery process periodically.

5. Use strong passwords and multifactor authentication

Weak credentials can allow attackers to access systems and move through networks. Use unique passwords for important accounts, store them in a reputable password manager, and enable multifactor authentication wherever possible.

Restrict administrator privileges so everyday applications cannot make unnecessary system-wide changes.

6. Secure your network

Keep routers, servers, and other network-connected devices updated. Disable services you do not need, restrict remote access, and separate sensitive systems from ordinary user devices.

Organizations should also monitor network traffic and maintain an incident response plan. Early detection can limit the damage when an infection occurs.

7. Download software from trusted sources

Avoid pirated software, suspicious installers, and unexpected downloads. Malicious software may be bundled with files that appear legitimate, while compromised software updates can expose many users at once.

Verify that downloads come from the developer’s official website or a trusted distribution platform.

Final Thoughts

The worst computer viruses of all time show how quickly a technical weakness or a deceptive message can become a much larger security crisis.

MyDoom and ILOVEYOU demonstrated the reach of email-based malware, Conficker and SQL Slammer exposed the danger of unpatched systems, and WannaCry and NotPetya showed how attacks can disrupt essential services and international businesses.

The most useful lesson from these attacks is that prevention and recovery must work together. Keep software updated, verify unexpected messages, protect important accounts, and maintain reliable backups.

FAQ