The Brain Virus of 1986: The First PC Virus Came From Lahore

Most computer viruses hide their authors. Brain did the opposite. When it infected a floppy disk in 1986, it carried inside its code the names, address and phone numbers of the two brothers who had written it, in a shop in Lahore, Pakistan. It is generally considered the first virus for the IBM PC, and its story is more nuanced than the usual picture of a hacker in a dark room.

Who wrote it

Brain was written by Basit Farooq Alvi and his brother Amjad Farooq Alvi, who ran a computer shop in Lahore called Brain Computer Services. They sold, among other things, medical software they had written. Software piracy was common in the region at the time, and the brothers have said that their aim was to track and discourage the unauthorised copying of their own programs.

The virus included a text message that contained the shop's name and contact details, and told people to contact the brothers to receive a vaccine. This was unusual. It is part of why the story is often told as a protest against piracy that went further than its authors expected.

How Brain worked

Brain was a boot sector virus. On floppy disks of the time, the first sector contained a small program that the computer ran when it started from that disk. Brain replaced that boot sector with its own code, moving the original to another location on the disk. When someone started a computer from an infected floppy, the virus loaded into memory. After that, any new floppy disk inserted into the machine would be infected as well.

The virus tried to hide itself. If a user looked at the infected boot sector, Brain intercepted the request and showed the original contents instead. This kind of trick, now called stealth, was an early sign of how much cleverness malware would develop.

What it did not do

Brain was not designed to destroy data. It slowed disk access slightly and could mark some disk space as bad, which made that space unusable. For most users the main effect was confusion, plus the unsettling discovery that their disks carried a stranger's name.

How it spread

In the 1980s, software moved from person to person on floppy disks. There was no widespread internet. A virus therefore spread at the speed of human habits: people lending disks to colleagues, bringing work files home, or copying programs from a friend. Brain travelled with travellers, and it appeared in universities and offices in several countries in 1986 and 1987.

That slow, physical spread looks quaint today, but it also made the virus hard to track. Users often had no way to know where an infection had started.

What happened afterwards

The brothers began to receive phone calls from around the world, as people looked for the promised cure. Reports say they were surprised by the reaction. The shop continued to operate, and the brothers later went on to run an internet service provider in Pakistan.

For the computing industry, Brain was a turning point. It showed that PCs, which had been mostly isolated from this kind of threat, could be infected through ordinary use. Antivirus tools began to appear in the following years, and the word virus entered everyday use for software, not just biology.

News of Brain reached the press as it began to surface on university machines, and it made an impression partly because of its odd transparency. Most people expected a threat to come from a faceless stranger. Instead the virus carried a street address and telephone numbers, and callers really did ring Lahore. The incident was one of the first times that the general public heard that computers could be infected at all.

Researchers analysed the code and published descriptions. Because Brain was relatively simple, it became a teaching example for how boot sectors work. In the years that followed, other boot sector viruses appeared, many of them far more destructive, and the techniques used to detect them became the foundation of early antivirus scanning: looking for known byte patterns in files and in the boot area of a disk.

Lessons beyond the headline

• Intent does not control impact. The authors wanted to deter piracy. The result was a program that spread to places they could not predict.
• Visible signs matter. Brain announced itself. Modern malware usually does not, so you need tools that look for it.
• Shared media spread infection. Today the equivalent is shared files, plugins, themes and downloaded software.

The lesson for site owners today

The modern floppy disk is the plugin, theme or script that you download from somewhere. Free copies of paid WordPress themes, sometimes called nulled themes, are a well-known route for hidden backdoors. Even a legitimate plugin can become a risk if it is abandoned and left unpatched. Treat every extension as code that runs with your site's privileges, because it does.

• Install themes and plugins only from sources you trust, and avoid pirated copies completely.
• Remove extensions you no longer use.
• Check that the ones you keep are still maintained.

If you are unsure where to start, you can contact the team.

A safer starting point

If you run WordPress, a hosting setup that makes updates and backups easy removes much of the day-to-day risk. See our WordPress hosting plans, and if you are moving a site that may already be infected, talk to us first through our contact page so it can be checked before migration.