The First Antivirus Programs: How 1987 Created a New Industry

Before 1986, the idea of selling a program to protect a personal computer from viruses would have seemed odd. There were hardly any viruses to protect against. Within two years, that changed. A handful of programmers in different countries, working separately, wrote the first tools to find and remove the new threats. Their work created a software industry that is now worth many billions, and the basic approach they invented is still in use.

A sudden crop of viruses

Brain appeared in 1986. In 1987 and 1988 came a wave of others. The Jerusalem virus, found at the Hebrew University in Israel, triggered on Fridays that fell on the 13th and deleted programs. The Lehigh virus spread through Lehigh University's computers and destroyed data. The Stoned virus, which probably originated in New Zealand, spread widely on floppy disks. In Austria the Vienna virus infected executable files. Computer users and administrators who had never thought about the possibility were suddenly facing it.

The first removal tools

Several independent efforts date to 1987. One of the best-documented is the work of Bernd Fix, a German programmer who wrote a program to remove the Vienna virus. It is often described as the first known case of a virus being removed by a dedicated tool, though people used the word antivirus loosely at the time, and a number of programmers claim early work.

In Germany, Andreas Lüning and Kai Figge, the founders of G Data, developed an early antivirus program for the Atari ST computer, which the company has described as one of the first commercial antivirus products. In the United States, John McAfee founded McAfee Associates in 1987 and began distributing a scanner as shareware. In Czechoslovakia, two programmers who responded to the Vienna virus began work that led to the Avast antivirus. In Iceland, Fridrik Skulason released F-PROT in 1989. A few years later, in 1989, Eugene Kaspersky began studying viruses in the Soviet Union after an encounter with the Cascade virus, and he eventually co-founded the company that carries his name.

How early scanners worked

The technique that these programs shared was simple. Researchers took a copy of a virus, found a short sequence of bytes that was unique to it, and wrote a program that searched files and disks for that sequence. This is called a signature. If a file contained the pattern, it was probably infected.

The approach had clear strengths. It was fast, it produced few mistakes for well-chosen signatures, and it could be updated by publishing a new list. It also had an obvious weakness: it could only find viruses that someone had already seen and analysed.

The arms race begins

Virus writers soon realised that if the scanner looked for a fixed pattern, they could change the pattern. Viruses began to encrypt their bodies, with only a small decryptor left in plain view, and then to mutate that too, in what were called polymorphic viruses. Antivirus vendors answered by emulating the code to see what it would do and by looking at behaviour, not only at bytes. This cycle of evasion and detection never ended.

Another important development was sharing. Researchers realised early that no single company could see every new virus, so they exchanged samples and information. Informal networks of analysts, often communicating through bulletin boards and later through the internet, became a core part of the field. The same spirit of sample sharing continues today among security vendors, who regularly exchange new malware so that all their customers are covered faster.

The first antivirus authors also faced a question that every product in the field still faces: how to avoid false alarms. A scanner that flags a harmless file as infected can frighten users and break working software. Choosing signatures carefully, and testing them against large collections of clean files, became a basic part of the craft from the beginning.

A business model emerges

Because new viruses appeared constantly, the first antivirus tools needed regular updates. That fitted naturally with a subscription: you bought the program once, then paid for a regular supply of new signatures. The model, which started on floppy disks sent in the post and moved to downloads through bulletin boards and then the internet, remains the base of the industry. Large technology companies also entered the market, and the Norton line from Symantec became widely known in the early 1990s.

What antivirus can and cannot do

• It can find known malware and block it before it runs.
• It can sometimes detect new malware by its behaviour.
• It cannot fix flaws in your own software, or protect against a stolen password.
• It works best as one layer among several, not as a complete defence.

The lesson for site owners today

The same ideas apply to websites. Malware scanners for web servers look for known signatures in files, such as PHP backdoors, and they can catch common infections. But they do not replace patching, strong credentials and clean backups. A scanner tells you that something is wrong. It does not tell you how the attacker got in, and if you only delete the infected file, they may come back through the same door.

After any compromise, find the entry point, change all relevant passwords, update everything, and restore from a clean backup if there is any doubt about what was changed.

If your site runs on WordPress, WordPress hosting is built around keeping it updated.

Practical help

If you suspect your site is infected, get in touch and we can look at it with you. For the longer term, a managed WordPress hosting plan with Plesk makes updates, backups and scans easier to keep on schedule, and the security page lays out the wider approach.