What is a computer virus?
A computer virus is malicious software that attaches to a file or program and spreads when that file is run. The term “virus” is often used loosely to describe other types of malware, including worms and ransomware, though they differ in important ways. Unlike viruses, which need a host file to spread, worms self-replicate and spread on their own. Meanwhile, ransomware is a class of malware that encrypts a victim’s files and demands payment for their release. In this article, we’ll use “virus” in its broad, everyday sense that covers all three types.
Below we look into the 12 worst computer viruses (malware) of all time, which is technically the last 50 years.
The worst computer viruses ranked by damage and impact
Cybersecurity experts generally note the following as the top 12 worst viruses based on damage, spread, and overall impact:
| Virus | Year | Type | Scope | Estimated damage, USD |
| | | | |
| | | Estimated between two and several million computers |
| |
| | | | |
| | | | |
| | | ~230,000 computers in 150 countries |
| |
| | | Estimated millions of computers worldwide |
| |
| | | | |
| | | Half of internet servers in 15 min |
| |
| | Worm (industrial sabotage) |
| | |
| | | | ~tens of billions combined |
|
| | | | |
| | | | |
Note: Damage figures are estimates that vary by source and measurement method (cost vs. spread vs. money stolen).
1. MyDoom (2004): Roughly $38 billion in damage
MyDoom is the costliest virus in the history of computing, with an estimated $38 billion in global financial damage. It was discovered and named by Craig Schmugar, a McAfee virus research manager at the time, who noticed the line of text “mydom” in the malware’s code. He added “doom” to the name, sensing that it would be fitting for a threat this big.
And he wasn’t wrong. MyDoom became one of the fastest email worms to spread around the world. The worm appeared as an email transmission error and contained an attachment of itself. If the user clicked on it, it immediately sent itself to all the email addresses in the user’s address book.
MyDoom slowed the internet down by up to 10% on the day of its release, infecting roughly 2 million computers worldwide and earning the title of the biggest virus in history.
2. Sobig.F (2003): Around $37 billion in damage
Sobig was not only a self-replicating computer worm, but also a Trojan disguising its true content. Sobig.F would usually turn up in emails with subject lines like “Re: Thank you!,” “Your details,” “Re: Details,” and many others.
Due to the sheer volume of emails that it was able to send, the worm eventually brought down computer traffic in Washington, D.C., slowed down computer systems of large corporations, and even caused Air Canada to be grounded.
An estimated 2 million computers were infected, with roughly $37 billion in damage.
3. ILOVEYOU (2000): About $10-$15 billion in damage
ILOVEYOU was a 2000 email worm that infected about 50 million computers, causing an estimated $10-$15 billion in damage. The virus would infect computers through email, appearing as a love confession to the recipient. Once people clicked on the attachment, it immediately sent itself out to everyone in the user’s email list, overwrote files, and made the infected computer completely unbootable.
Computers would also copy users’ passwords and then send them back to the authors of the virus. This was potentially catastrophic for large corporations and governments. Having spread among roughly 50 million computers in just 10 days, it caused the CIA, Pentagon, and a host of large corporations to shut down their email systems. To this day, ILOVEYOU remains a textbook example of a successful social engineering attack.
4. WannaCry (2017): Around $4 billion in damage
WannaCry was a ransomware worm that infected more than 230,000 computers across 150+ countries, causing an estimated $4 billion in damage. It spread using the EternalBlue exploit — a leaked NSA hacking tool that targeted a vulnerability in Windows systems — that allowed the virus to move automatically between computers without any user interaction.
Once inside a system, WannaCry encrypted the user’s files and demanded a ransom payment in Bitcoin for their release. The attack was devastating for organizations running outdated Windows versions. Most notably, it forced the UK’s National Health Service (NHS) to shut down parts of its system, canceling thousands of appointments and diverting ambulances from affected hospitals.
The outbreak was eventually slowed when a security researcher discovered a “kill switch” domain hidden in the malware’s code. Almost a decade later, WannaCry remains one of the most notorious ransomware attacks in history.
5. Conficker (2008): Roughly $9 billion in damage
The Conficker worm was first spotted in 2008, causing panic among Windows users. The malware weaponized a critical, unauthenticated remote code execution vulnerability in the Windows Server service, tracked as CVE-2008-4250 and patched by Microsoft via the MS08-067 security bulletin. Once inside a computer, the worm could grant itself administrator rights on infected computers, delete system restore, block users from searching any information on malware removal, look for uninfected computers in the network, and execute programs.
Besides personal computers, the virus managed to infect the networks of the armed forces of Germany, the French Navy, and the United Kingdom Ministry of Defense.
Cybersecurity experts believe that Conficker was created by Ukrainian hackers, as it was programmed not to attack computers with a Ukrainian keyboard.
It is estimated that Conficker managed to infect around 15 million computers worldwide and cost more than $9 billion. As of today, Conficker is still alive and running, but is not as notorious as it was.
6. Zeus (2007): Approximately $3 billion stolen
While Zeus is the king of gods in Greek mythology, it is also one of the worst Trojans ever created. Zeus (also known as Zbot) was designed to steal information such as credit card details and passwords from computers. Since its appearance in late 2007, Zeus has managed to extract confidential information from NASA, The Bank of America, Amazon, and CISCO, just to name a few.
Armed with these credentials, hackers deployed money mule networks to drain compromised accounts through unauthorized wire transfers. In 2010, international law enforcement crackdowns revealed that global cybercrime rings had attempted to steal a staggering $220 million directly from these accounts — and that’s not including all the system cleanup costs that came after.
The malware’s original developer didn’t execute the bank heists themselves. Instead, they pioneered the underground “Malware-as-a-Service” industry by selling the automated toolkit to criminal factions on the dark web for as little as $1,000. They would also sweeten the deal by offering buyers 24/7 technical support and software updates. Though the creator leaked the source code in 2011 and retired, Zeus’s original blueprint remains the foundational architecture for modern financial malware.
7. Code Red (2001): Around $2.6 billion in damage
The Code Red internet worm exploited a vulnerability in Windows NT and 2000, triggering a massive global internet disruption by targeting Microsoft IIS web servers running on Windows NT and 2000. It exploited a vulnerability in the indexing software — officially tracked as CVE-2001-0500 — triggering a remote buffer overflow by sending a malicious web request containing a long, repeated string of the letter “N”. This memory overload forced servers to execute the worm’s instructions directly from RAM.
As the self-propagating malware spread, hijacked servers scanned the web for more victims while defacing public web pages with the text “HELLO! Welcome to http://www.worm.com! Hacked By Chinese!” On a designated day of the month, infected hosts shifted their behavior to launch a massive Distributed Denial of Service (DDoS) attack aimed at a hardcoded numerical IP address that belonged to the White House website. System administrators successfully countered the strike by simply changing the site’s IP address.
Running entirely in volatile system memory, Code Red compromised over 1 million computers worldwide and caused an estimated $2.6 billion in global damage, a figure largely driven by the sheer cost of system remediation and lost productivity.
8. SQL Slammer (2003): Over $1 billion in damage
SQL Slammer (also known as Sapphire) was created in 2003 and in only 15 minutes infected half of the servers that ran the internet, causing a worldwide bandwidth slowdown.
Slammer installed itself on computers by running a false version of a Microsoft database package called SQL Server 2000. Since it was mainly used by system administrators, it didn’t have an effect on regular users. Slammer generated tremendous amounts of network packets, overloading servers and routers.
In the US, most of the 13,000 ATMs operated by Bank of America became unusable. South Korea almost lost all its internet access. The total cost of this malware exceeds $1 billion.
9. Stuxnet (2003): Over $1 billion in damage
Stuxnet was a highly sophisticated computer worm discovered in 2010. It became the world’s first cyber-weapon designed to cause physical destruction. Engineered by nation-states (widely attributed to the United States and Israel), the worm successfully infiltrated Iran’s air-gapped Natanz nuclear facility using infected USB drives and an unprecedented four zero-day vulnerabilities.
Once inside, the worm targeted Siemens software controlling industrial machinery, secretly forcing nuclear centrifuges to spin at dangerous speeds until they tore themselves apart. To deceive operators, Stuxnet played back fake, normal telemetry to the control room monitors. The malware destroyed roughly 1,000 centrifuges, proving for the first time that lines of code could physically sabotage critical national infrastructure.
10. Sasser and Netsky (2004): Billions in damage
Sasser and Netsky were two viruses created in 2004 by a 17-year-old German named Sven Jaschan. While at first no one assumed the viruses were connected, soon researchers discovered that they used a similar code.
The Sasser worm would open up 128 separate scanning threads and generate thousands of random public IP addresses in search of vulnerable systems, instructing them to download the virus. It also made changes in the operating system so you could shut down the computer only by unplugging it. Within 48 hours Sasser infected 1.3 million computers, halting rail service in Australia, forcing Delta Airlines to cancel several flights, and making Finland’s Sampo bank close 130 branches.
The Netsky virus existed as an email attachment. Once opened, it would send emails to all the contacts, spreading itself even further. Netsky was said to be one of the most dangerous viruses of 2004, as it caused 1 in 5 virus incidents that year.
It is believed that Sasser and Netsky were responsible for at least a couple of billion dollars of damage. Since Sven Jaschan was underage at the time he created the viruses, he spent no time in jail and even got a job offer at a cybersecurity company.
11. Melissa (1999): Around $80 million in damage
First appearing in March 1999, the Melissa virus became the first widely publicized mass-mailing macro threat. Created by programmer David L. Smith, the malware was distributed as a malicious Microsoft Word document disguised as a list of login credentials for adult websites. Tempted by the promise of free passwords, users opened the attachment, inadvertently executing a hidden script inside the document.
Once opened, the virus would hijack Microsoft Outlook to automatically email the infected document to the top 50 people in the user’s address book. The distribution of the virus became exponential, causing massive pressure on email traffic worldwide. It is estimated that the Melissa virus caused $80 million worth of damage.
Following his arrest, the hacker responsible for the attack helped the FBI catch other virus creators and got off with only 20 months in prison and a $5,000 fine.
12. CryptoLocker (2013): Roughly $3 million in ransoms
CryptoLocker is a ransomware that spread through email attachments, encrypting users’ files with a 2048-bit RSA public key and asking for payment. Victims had about 72 hours to pay a ransom of around $400 — otherwise, their files would be destroyed.
CryptoLocker affected more than 500,000 users, but only 1.3% paid the hackers. Despite the low response rate, the criminals managed to collect around $3 million. Security experts took over CryptoLocker’s database of victims and created an online portal where users could get the key to decrypt their files.
Cybersecurity experts agree that CryptoLocker inspired many wannabe hackers to start using its code to create their own viruses.
How do computers get infected by viruses?
Computers usually get infected through a combination of user unawareness and an attacker’s malicious intent, specifically:
- Malicious email attachments and phishing attacks. Booby-trapped files and fake login pages can trick users into installing malware themselves.
- Unpatched software vulnerabilities. Attackers exploit known security holes in outdated operating systems, browsers, or apps, often with no clicks required.
- Drive-by downloads and malicious pop-ups. Compromised websites or deceptive “update” buttons install malware the moment a page loads or a button gets clicked.
- Infected files from untrusted sources. Cracked software, pirated media, and random downloads often hide malware bundled inside a tempting freebie.
Since viruses most commonly breach systems through malicious attachments, outdated software, and sketchy websites, it’s important to watch out for suspicious links and emails, update your software regularly, and invest in your online security.
How to protect yourself from computer viruses
To protect yourself from computer viruses, invest in your cybersecurity and pick up some simple yet effective online security habits:
- 1. Update your software regularly. Set up automatic updates for your operating system, important apps, and antivirus programs, and make sure to install software security updates as soon as they’re released.
- 2. Don’t click links or attachments in suspicious emails. Phishing emails from unknown senders are one of the most common ways for malware to get in. If a message, link, or email attachment looks fishy, don’t click on it.
- 3. Be careful on public Wi-Fi. Open hotspots can expose you to man-in-the-middle attacks and snooping, so avoid accessing sensitive accounts on public Wi-Fi networks, or use a VPN to encrypt your connection.
- 4. Don’t click pop-ups. Pop-up alerts claiming your computer is infected are almost always scams designed to install malware or adware — close the tab or browser instead of clicking anything in the alert.
- 5. Only download software and files from official, trusted sources — installers from unknown sites often bundle malware.
- 6. Keep your device’s built-in security features enabled. Firewalls and default OS protections add an extra barrier against infections.
For an additional layer of protection, use NordVPN’s next-gen antivirus — it helps identify malware-laden files, warns you before you land on malicious sites, and blocks trackers and intrusive ads. You can find more information in the next-gen antivirus whitepaper.
