Creeper, written by Bob Thomas at BBN around 1971, is usually called the first computer virus. It did not steal anything, encrypt anything or break anything. It copied itself from one machine to the next and printed a line: “I’m the creeper, catch me if you can!” Someone then had to write a second program to chase it down.
It was an experiment, not an attack. Creeper was a program that ran on DEC PDP-10 machines under the operating system and moved between them over the . Its whole payload was the message it displayed. Because it kept spreading, a second program called went out to find and delete copies, which gives it a claim to being the first antivirus as well.
Creeper is the program usually named when people ask what the first computer virus was. Bob Thomas wrote it at BBN, the company then building much of the ARPANET, around 1971. It was explicitly an experiment in self-replicating code rather than an attempt to damage anything.
The machines matter to the story. Creeper ran on DEC PDP-10 computers under the TENEX operating system, and it moved between them over the ARPANET. Once it arrived somewhere it printed its one line: “I’m the creeper, catch me if you can!” Then it looked for the next machine.
That taunt turned out to describe the problem it created. Copies accumulated faster than anyone wanted to clear by hand, so a second program, Reaper, went out across the same network to find Creeper and delete it. A self-replicating cleaner chasing a self-replicating nuisance is a fair claim to the title of first antivirus.
Two cautions. The History of Information page is a compiled entry, and it quotes Wikipedia for the technical detail, which is thin ground for exact claims about how the code worked. The year is given loosely in most accounts as well. What survives reliably is the shape of the thing: replication came first, and harm arrived later, as something people chose to add.
wat. The first computer virus did nothing but copy itself and taunt you in print.
wat wat
It separates two things that now always arrive together. Self-replication is a technical capability. Harm is a separate choice about what the replicating code carries. Creeper had the first without the second.
How do we know?
The History of Information entry for Creeper collects the account of Bob Thomas’s experimental self-replicating program at BBN. It gives the machines and network it ran on, the text it displayed, and the Reaper program made to remove it.
What is still unknown
A compiled reference entry rather than a primary record, and its technical detail is quoted from Wikipedia, so specifics such as the exact year and the precise behavior of the code should be held loosely.
Learn something?
Where to next
Which wall of lava lamps is guarding part of the internet?security
Does a long password have to be complicated as well to be strong?security
Can a message tell you it was intercepted?security