First off, it's worth pointing out that the term "computer virus" is more of a catch-all today than it used to be. Back in the day there was more concern placed on the precise sub-category of self-replicating malicious code, substantially because everything was slower, less connected, and there were fewer programs that were running constantly.

So, let's take a brief excursion to talk about nomenclature. Strictly speaking a computer virus is malicious code which infects executable code (or perhaps scripts). When you run the infected code it runs the malicious self-replication payload, which searches out other places to infect, and inserts itself there. In a world where most PCs are not always on nor always connected, this method of replication was one of the most effective ways for malicious code to spread. However, even in the early days (primarily the '70s and '80s) there were growing numbers of always on "time sharing" computers connected to each other through different networks (and eventually through the overarching public network of networks which became known as the internet). Malicious code designed to infect other online systems was known as a "computer worm". And, to round things out, there are also "trojan horse" programs, which are malicious and might compromise a given system by tricking a user into running it by appearing to be something it's not, but generally are not self-replicating.

Even before the first actual examples of self-replicating code there were theoretical and even fictional portrayals. In the early '70s there were a few examples of the real thing, as research and as pranks. One of the very earliest was "Creeper" in 1971, which moved between PDP-10 mainframes connected to the ARPANET and caused "I'm the creeper: catch me if you can" to be printed to the connected teletype. Back then this was seen as fairly innocent research, especially since originally it existed as only one instance throughout the network (deleting its origin instance as it moved), though later versions switched to copying, making itself a proper computer worm. This gave rise to "Reaper" which also copied itself between computer systems and deleted copies of Creeper on machines it ran on. These and other fairly low-stakes hijinks eventually spawned a game called "Core War" in 1984, where players write programs to take over a virtual machine where they run alongside other programs (which will probably be self-replicating and will seek to overwhelm or destroy all other programs).

But let's not skip over the rise of boot sector viruses in the early '80s. The vast majority of early PCs had no hard drive, the only non-volatile storage they had was floppy disks (or punched/magnetic tape). A floppy disk would contain your OS, such as it was, and you would boot off of it. I won't get into too many details but part of the way this worked is that a specific and consistent location of the disk (the boot sector) would contain a program that would get loaded into memory and executed when the machine started up (which would then provide functionality for being able to do things like run other programs, use the filesystem, etc.) That consistency made it possible to hijack the boot sector, and put malicious code there, while still running the rest of the operating system afterward (by moving it to another sector). Importantly, this malicious code would stay running in memory along with the OS while the computer was on, and if you inserted another floppy disk then it would have its boot sector modified and become infected. Because many programs, disks, and computers were shared in the '80s and '90s boot sector viruses eventually became fairly common.

The first major computer virus outbreak was indeed a boot sector virus, Elk Cloner in 1981, it was fairly innocuous, and simply a prank by a 15-year old student, but it did infect a fair number of Apple IIs, before the creator was "caught" and wrote a utility to remove it.

Through the early '80s there were several other boot sector viruses, some of which spread fairly widely. At first the viruses were purely non-malicious pranks which did little other than print out messages. However, starting in the mid 1980s truly malicious viruses started popping up. The Jerusalem virus, originally created in 1987, infected huge numbers of computers. It would stay resident in memory and infect every executable file that was run by the user, and it contained a "payload" which would activate every Friday the 13th (after 1987) and delete every executable file that was run on that day.

There is, of course, the famous "Morris Worm" of 1988, the inspiration for the opening scene of the movie Hackers. It was not intentionally malicious, but more of a security exploit proof of concept, nevertheless it infected several thousand Unix systems connected to the early internet, and due to a coding error in the worm caused many of them to slow down or crash, resulting in on the order of a million dollars in damages. The writer of the worm, Robert Tappan Morris, a student at MIT, was tried and convicted for writing the worm but was let off with fairly light punishment of probation, community service, and a fine.

The late '80s were a major inflection point for computer viruses due to the massive proliferation of computers as well as the vast growth of ways to connect them (such as the internet and BBSes). Before the end of the '80s you see individual viruses diversify into families of related viruses with slightly different code and payloads. You see the rise of ransomware. You see "polymorphic" viruses which can mutate their binary code while retaining the same functionality, as a means to evade detection by simplistic pattern matching anti-virus systems. By the early '90s computing and viruses had become so widespread that many computer users had direct exposure to them, and they were starting to garner media attention. In 1992 there was a lot of fear of the Michelangelo virus (a boot sector virus for PCs), which was set to corrupt the hard drives of large numbers of infected computers on March 6th, though it turned out to have only spread to a few tens of thousands of systems instead of the millions widely reported in the media. Though soon after other viruses would infect millions of computers and the arms race between virus writers and those trying to stop them would take off.

I'll briefly touch on the ILOVEYOU email worm from 2000, since that'll bring us up to the limits of the AskHistorians time horizon (and, unfortunately, we won't get to talk about CodeRed, Sasser, SQL Slammer, and all the other fun evolutions of the early 2000s). ILOVEYOU is interesting for several reasons. One, it's not executable (binary machine) code, it's written in a scripting language (vbscript). Another is that it is a bit of a trojan, it requires tricking the end-user into clicking on a file attachment (LOVE-LETTER-FOR-YOU.TXT.vbs) in order to execute. When run it sends a copy of itself to all addresses in the user's Microsoft Outlook address book along with some various malicious activities (deleting mp3s and MS Office files, for example). What's even more interesting about this is that in order for it to work it relied on the fact that every aspect of the computer system was engineered with very little thought to security concerns. Want to run a script that can do anything on your computer? Sure, just click it. Want to send a script like that as an email attachment to everyone? Sure, no problem, easy peasy.

All of these examples illustrate just how hard won the lessons of computer security have been, and how difficult it has been to make progress in that realm year over year. The year 2000 wasn't exactly the dark ages, and yet every aspect of the computer systems most people were using were built on mountains of naivete. And users were so unprepared for the possibility of an email attachment hijacking their system that millions upon millions of them blindly clicked out of sheer curiosity.