Welcome to the Computer Security Wiki! You can help us by expanding stubs, create new articles and improve current articles.
You can also help us by logging-in or creating an account!

Elk Cloner

From Malware Wiki
Jump to: navigation, search
Elk Cloner
elk-cloner.gif
TypeBoot sector virus
CreatorRichard Skrenta
Date1982
OriginMount Lebanon, PA, USA
Programming LanguageAssembly
PlatformApple II
This box: view  talk  edit

Elk Cloner has the distinction of being the first wild virus for a home computer, and was the first known computer virus. Coded by then-high-school student, Richard Skrenta, around 1982, it did not do much more than cause some annoyance by periodically displaying a message and probably did not spread much further than the computers of a few of Skrenta's friends and his math teacher. It was also completely harmless, save for causing some annoyance. The virus began spreading when Skrenta gave away copies of pirated programs with the virus on them.

Richard Skrenta often traded pirated software on disks with friends. He was well-known for using disks to pull pranks on friends, who began to distrust any disks they received from him. His disks often displayed taunting messages. Elk Cloner was the first to spread on its own.

In 2007 July, many Internet sites began reporting that the world had entered the 25th year of computer viruses, while others claimed that Creeper, created 15 to 10 years earlier than Elk Cloner was the first. Technically, Elk Cloner is the first virus, as Creeper does not require a boot sector or another file as a host, while Elk Cloner infects boot sectors. Regardless of definitions, Elk Cloner was the first virus or self-replicating program of any kind to work on a home computer.

Elk Cloner is an example of of the dangers of pirated software. The Brain DOS virus would be created a few years later for the purpose of preventing software piracy.

Payload

When an infected disk was booted, the virus would load into the memory. It would monitor disk accesses, and upon finding an uninfected floppy, infect its boot sector. The virus will only infect 5.25 inch floppy disks, as they were the standard type of disk in 1982 and a hard drive was unlikely to even be on a computer, as operating systems and programs were loaded entirely from floppies.

Elk Cloner did not cause any deliberate harm, although it overwrote the reserved tracks of the floppy disk regardless of the contents, damaging disks not containing the standard DOS image. Typical of many early viruses, it caused annoyance: on every 50th booting the virus would display a short "poem", which can be sung to the tune of the "Man Show" theme song:

ELK CLONER:
     THE PROGRAM WITH A PERSONALITY

IT WILL GET ON ALL YOUR DISKS
IT WILL INFILTRATE YOUR CHIPS
YES IT'S CLONER!

IT WILL STICK TO YOU LIKE GLUE
IT WILL MODIFY RAM TOO
SEND IN THE CLONER!

Sources