All products featured on WIRED are independently selected by our editors. However, we may receive compensation from retailers and/or from purchases of products through these links.
Experts agree: 1999 was a banner year for the computer virus. Despite that, the evidence suggests that 2000 won't start off with a new outbreak.
In 1999, virus writers began taking advantage of the Internet to spread menacing code that could burrow more deeply and propagate more quickly.
"It certainly made it what some call 'the year of the virus,'" said Vincent Gullotto, director of the anti-virus emergency response team at Network Associates.
The PC computer virus, now 13 years old, once spread by way of floppy disks and shared files. But in this breakthrough year, code-writers learned anew how to exploit email, the Internet's main engine for data exchange.
"We've seen a quite new threat-model when it comes to viruses," said Elias Levy, chief technology officer for Security Focus. "Nowadays they spread within days whereas before it would take weeks if not months."
Melissa, CIH and ExploreZip were the marquee names that opened the year, with Minizip and Babylonia among the hits of the fall.
"Internet-based technologies [like email] either propagate the virus, or when the virus activates, it does damage via the Internet," said Mikko Hypponen, manager of anti-virus research F-Secure. "That was not possible a couple of years ago."
April's CIH virus affected an estimated 2.5 million-plus computers and was capable of deleting all the files on a disk drive and of overwriting a computer's memory.
Research firm Computer Economics said businesses worldwide lost a total of US$7.6 billion in the first two quarters because of viruses.
While CIH may have effected large numbers of PCs, the mold-breaker was Melissa. Melissa's feats, Levy and other virus experts said, took the craft of virus-writing to a new level. Most major viruses of 1999 were in fact copycats taking their cues from Melissa's source code.
"It was the first widespread email-based worm. It was the first virus to go global in six hours," said Hypponen. "I'm surprised we haven't seen more Melissa wannabes."
Melissa bombed the Net over one weekend in March, wreaking havoc the following Monday as workers returned to offices and began reading their email. Melissa was delivered as an email attachment that listed pornography sites and took advantage of Microsoft "macros," software embedded in the Windows operating system that sets off a sequence of computer functions with one command.
The virus then caused the infected machine to send out spurious emails, overloading servers Internet-wide.
"Prior to '99 we had seen glimpses [of email virus potential], but not to the effect of something like Melissa and ExploreZip," said Gullatto.
The changes are not all technological, however. The informed or uninformed human being can make a big difference in a virus's success, Levy pointed out.
"It becomes a social problem as well," he said. "You may think you can trust an email simply because it comes from someone you trust." This human element makes viruses in the Internet age more difficult to control.
"There's no way to fix the behavior problem except by educating people," Levy said. "That's one thing we can only learn the hard way."
And as for the next year starting off with a new rush of viruses?
While some anti-virus companies have been playing up the possibility of a New Year's-specific strains, the claim is almost completely unfounded according to experts like Hypponen.
"The Y2K virus issue has been overblown, over-hyped," he said, "And it's mostly done by companies in the anti-virus industry. I don't think we'll see Y2K-specific viruses."
He admits that his own employer has played the publicity game to draw attention to legitimate virus threats, but said the company has been careful to not cry wolf in the case of Y2K. Simply because there is scant evidence of major virus looming to strike on the New Year.
Hypponen also noted that it's not easy to make a successful virus and achieve distribution on the scale of Melissa and others. The six major cases this year were the exception to the rule. "It's still gonna take some luck," he said.
Levy argued that cases for and against the sudden appearance of Y2K-specific viruses have merit. Virus writers are likely want to cause confusion on the big day, he said. But at the same time, general preparedness is so high that it's more likely than ever that a surprise viral appearance will be caught before it can strike.
"I don't think it will be the catastrophe that some people have said it will be," Levy said.
Gullatto of Network Associates remains among the cautious. Even if it's not at the flip of the calendar, viruses may be poised to strike on employees first day back to work -- around the 4th and 5th, he said.
"That's when ExploreZip started to happen -- the days people start to come back to work are the real days we need to be concerned with," Gullatto said.
If not from the get-go, the year 2000 may see further refinement of the increasingly tricky viral art -- and more business for companies like Gullatto's Network Associates.
"I don't know that we've seen the worst of it," said Gullatto. The debut of Microsoft Windows 2000, Office 2000, and Internet Explorer 5 gives code writers more avenues to explore, he said.
