# The worm era, 1999-2008: Melissa to Conficker, and the patch that always existed

> Seven outbreaks in nine years took email, then web servers, then databases, then any reachable Windows machine. In almost every case the fix had shipped weeks or months earlier and had not been installed - and in the last one, Microsoft's bulletin had said in writing that the flaw was wormable. This is the era that produced automatic updates, the on-by-default firewall, and the argument the industry is still having.

Source: https://ronutz.com/en/learn/the-worm-era  
Updated: 2026-09-07

---

## The shape of the decade

Between 1999 and 2008 a particular kind of event happened repeatedly: a self-propagating program spread across the internet faster than people could respond, and the world found out what was connected to what. Read in order, the seven best-known outbreaks show two things moving at once. The infection route travels down the stack - from a document a person opens, to an email a person opens, to a web server nobody touched, to a database port, to any reachable Windows machine. And the window between the fix and the outbreak stays open the whole time.

## 1999: Melissa, and the feature that was the vulnerability

On 26 March 1999 David L. Smith posted an infected Word document to a Usenet newsgroup, claiming it held passwords for adult websites. Opening it caused Microsoft Word to use Outlook to mail copies to the first fifty addresses in the victim's address book, arriving as an "important message" from a known colleague. Fifty times fifty times fifty: it disrupted around a million accounts and some organisations shut off email entirely. The Department of Justice put the damage above 80 million dollars. Smith was arrested within a week, pleaded guilty, and was sentenced to twenty months - among the first people ever imprisoned for writing a virus.

There was no vulnerability. Word macros running automatically and Outlook being scriptable were both features, working as designed. That is the uncomfortable starting point for the decade: the first mass outbreak exploited nothing but the intended behaviour of two products, and the fix was to change what the products were willing to do.

## 2000: ILOVEYOU, and the missing law

On 4 May 2000 an email with the subject ILOVEYOU and an attachment named LOVE-LETTER-FOR-YOU.txt.vbs reached tens of millions of machines. Windows hid the final extension, so the file looked like a text file and was a script. Like Melissa it mailed itself onward; unlike Melissa it overwrote files. Damage estimates ran into billions.

The interesting part is the aftermath. Investigators traced it to Onel de Guzman, a 24-year-old student in Manila. All charges were dropped, because the Philippines had no law against computer crime - the charges brought under a credit-card-fraud statute did not fit, and a computer crime law was signed only weeks later. In 2020 de Guzman told journalists he had written it to steal dial-up passwords because he could not afford internet access, and had not anticipated what it would do. A global outbreak, a known author, and no offence on the books: the case is one of the reasons cybercrime legislation exists in the form it now does in most countries.

## 2001: Code Red and Nimda, and the end of user involvement

Code Red changed the model. Released on 13 July 2001, it needed no user at all: it sent a single HTTP request to a web server, overflowing a buffer in an indexing extension of Microsoft's Internet Information Services, and the server ran it. On 19 July the number of infected hosts reached 359,000. Infected pages were defaced with "Hacked By Chinese!", and the worm was programmed to launch a denial-of-service attack on the White House website.

Three details from the researchers' own announcement are worth keeping. The team at eEye that analysed it named it after the soft drink that kept them awake through the night doing so. The worm checked for a file called `c:\notworm` and, if it existed, did not spread - an off switch left in by the author. And the White House attack targeted an IP address rather than a name, so the definitive remedy was to move the site to a different address. The flaw had been published by eEye on 18 June and patched by Microsoft in bulletin MS01-033 about a month before the worm appeared.

Nimda followed on 18 September, a week after the September 11 attacks, and its innovation was breadth: it spread by email, by open network shares, by infecting web pages that visitors then downloaded, by scanning for Code Red's leftover backdoors, and by attacking IIS directly. A defender who blocked one route found the others still open.

## 2003: Slammer, the fastest thing that ever happened

At around half past five in the morning on Saturday 25 January 2003, a worm of 376 bytes - small enough to fit in one UDP packet, sent to port 1434 with no handshake and no waiting for a reply - began scanning the internet. It doubled every eight and a half seconds. Within ten minutes it had reached ninety per cent of the vulnerable machines on the internet, roughly 75,000 servers running Microsoft SQL Server or the desktop engine embedded in dozens of other products, which many administrators did not know they had installed.

It carried no malicious payload. The damage was purely the traffic: 13,000 Bank of America cash machines went offline, South Korea lost internet and mobile service for 27 million people, flights were cancelled, and emergency call services were disrupted. The [memory safety article](https://ronutz.com/en/learn/memory-safety) explains the class of bug underneath.

Microsoft had published the patch, MS02-039, on 24 July 2002. Six months.

Blaster arrived in August of the same year through a different door - a buffer overflow in the DCOM remote procedure call service on TCP port 135 - rebooting machines in a loop and attacking Microsoft's own update site. The patch, MS03-026, had shipped about a month earlier. By now the pattern is not a pattern; it is the definition of the era.

## 2008: Conficker, and a bulletin that said so

Then a gap, and then the last one. On 23 October 2008 Microsoft issued an emergency out-of-band update, MS08-067, for a flaw in the Windows Server service, and wrote in the bulletin that it was possible the vulnerability could be used in the crafting of a wormable exploit. That is the vendor predicting the worm in the document announcing the fix.

The first Conficker variant appeared around 21 November. Later variants spread over local networks, through removable drives, and by guessing weak administrator passwords on network shares. Its command channel was the innovation that outlived it: rather than a fixed server that could be seized, it generated 250 domain names a day from an algorithm seeded with the date, so defenders had to register or block a moving target - which produced the Conficker Working Group, an unprecedented coordination between security companies, registries and country domain operators, several of whom blocked thousands of names in advance. Microsoft offered a 250,000 dollar reward. Infection estimates ran into the millions; the counts varied by vendor and method and should be read as approximations.

As late as January 2009, an estimated thirty per cent of Windows machines were still unpatched. The botnet was enormous, resilient, and, so far as the public record shows, never used for much.

## What ended it, and what did not

The outbreaks stopped being routine for reasons that were mostly not clever. Windows XP Service Pack 2 turned the firewall on by default, which removed the reachable ports the network worms depended on. Automatic updates became the default rather than an option, which closed the window between patch and installation for consumers. Macros stopped running without asking. The vendor reorganised around the problem. Those changes, unglamorous every one, did more than any product.

What did not end is the gap. Nine years of outbreaks all had a fix available first: a month for Code Red, a month for Blaster, six months for Slammer, four weeks and an explicit warning for Conficker. Fourteen years after Slammer, [WannaCry and NotPetya](https://ronutz.com/en/learn/eternalblue-wannacry-notpetya) spread through a flaw patched fifty-nine days earlier - and one of the Microsoft responders who worked on Conficker made exactly that comparison when the 2017 attacks landed. Patching hygiene, he noted, remains poor in the places least able to fix it: hospitals, public bodies, old machines nobody owns.

For a practitioner the transferable lesson is not "patch faster", which everyone already knows and few can do. It is the three questions this decade keeps asking. **What is reachable?** - Slammer found database engines embedded in products whose owners did not know they were running one. **What is exposed by default?** - the firewall change ended more worms than any signature. **And what is the actual gap between a fix existing and a fix being installed, in your estimate, measured?** That last number is the one every entry above was decided by, and it is the one most organisations still cannot state.

## Sources

- [United States Department of Justice, on the Melissa sentencing: Smith admitted creating the virus and disseminating it from his home computer; it appeared on thousands of email systems on 26 March 1999 disguised as an important message from a colleague, was designed to send infected email to the first 50 addresses, and caused more than 80 million dollars of damage](https://www.justice.gov/archive/criminal/cybercrime/press-releases/2002/melissaSent.htm)
- [Wikipedia, Melissa: released by David L. Smith on 26 March 1999 and posted to a newsgroup with a claim that it contained passwords for adult sites; it disrupted about a million email accounts and led some organisations to suspend email; Smith was arrested less than a week later and sentenced in 2002 to twenty months](https://en.wikipedia.org/wiki/Melissa_(computer_virus))
- [ABC News and CNN, August 2000: Philippine prosecutors dropped all charges against Onel de Guzman because the charges either did not apply to computer hacking or lacked evidence; until a law signed in June 2000 the Philippines had no laws specifically against computer crimes; the virus was unleashed on 4 May and caused damage estimated up to 10 billion dollars](https://abcnews.com/Technology/story?id=119536&page=1)
- [Kaspersky, on ILOVEYOU: de Guzman was a 24-year-old student; he was not punished for lack of evidence and the absence of a criminal article for cybercrime in local law; in 2020 he said he created the worm to steal passwords for internet access because he could not afford to pay for it](https://www.kaspersky.com/blog/cybersecurity-history-iloveyou/45001/)
- [eEye's original Bugtraq announcement of Code Red: the .ida vulnerability eEye disclosed on 18 June 2001; the worm defaces pages with "Hacked By Chinese!" and was named partly because Code Red Mountain Dew was the only thing keeping the team awake to disassemble it; it spawns 100 scanning threads and checks for `c:\notworm` before propagating](https://diswww.mit.edu/menelaus.mit.edu/bt/21578)
- [Wikipedia, Code Red: released 13 July 2001, with infected hosts reaching 359,000 on 19 July; the flaw was in software distributed with IIS, described in MS01-033 (CVE-2001-0500), for which a patch had become available a month earlier; the worm did not check whether the remote server was even running IIS](https://en.wikipedia.org/wiki/Code_Red_(computer_worm))
- [Communications of the ACM, on the eEye analysis: the team led by Marc Maiffret determined the worm would launch a denial-of-service attack on the White House server at midnight GMT on 19 July, and that it targeted the site by IP address rather than URL - so the definitive repair was to relocate the server to another address](https://cacm.acm.org/opinion/the-code-red-worm)
- [SANS/GIAC analysis of Slammer: it emerged on 25 January 2003, doubled every 8.5 seconds for the first minute, infected 90 per cent of vulnerable systems within ten minutes and over 74,000 distinct machines; total size 376 bytes in a single packet to UDP 1434, needing no handshake; it carried no malicious payload but consumed bandwidth](https://www.giac.org/paper/gsec/2791/slam-sql-slammer-worm-lessons-learned/104742)
- [A second GIAC paper: Microsoft released MS02-039 on 24 July 2002, six months before Slammer was released into the wild; CAIDA reported it as the fastest spreading computer worm to date](https://www.giac.org/paper/gsec/3336/slamming-door-slammer-worm/105502)
- [ESET, on Slammer's effects: South Korea lost internet and mobile coverage for 27 million people, and almost all of Bank of America's 13,000 ATMs were knocked offline](https://www.welivesecurity.com/2016/09/30/flashback-friday-sql-slammer/)
- [Survey of major cyberattacks 2001-2013: Code Red infected 359,000 computers in under 14 hours; Slammer exploited a bug for which a patch had been available six months earlier; Blaster exploited the Microsoft remote procedure call interface and caused a denial-of-service attack on windowsupdate.com, even though patches were released a month before the attack](https://arxiv.org/pdf/1507.06673)
- [On Blaster's mechanism: multiple threads probe TCP port 135 for systems listening for RPC, then send oversized RPC requests triggering a buffer overflow in the DCOM interface, the flaw described in MS03-026 and designated CVE-2003-0352](https://grokipedia.com/page/Blaster_(computer_worm))
- [CAIDA, on Conficker: on 23 October 2008 Microsoft announced a security update resolving a critical vulnerability in the Windows Server service (MS08-067), stating in the bulletin that "it is possible that this vulnerability could be used in the crafting of a wormable exploit"; the first serious evidence of an outbreak was reported on 22 November 2008](https://www.caida.org/archive/ms08-067/conficker/)
- [Wikipedia, Conficker: despite the emergency out-of-band patch of 23 October 2008, an estimated 30 per cent of Windows PCs remained unpatched as late as January 2009; a December variant added propagation over local networks, removable media and network shares; variant A generates 250 domain names daily across five top-level domains, seeded with the current date; Microsoft offered a 250,000 dollar reward in February 2009; registries including those for Chile, Switzerland and Poland blocked generated names in advance](https://en.wikipedia.org/wiki/Conficker)
- [Help Net Security, a Microsoft responder's ten-year retrospective: MS08-067 affected the vast majority of Windows computers; patching hygiene remains poor, particularly in public bodies such as hospitals using old machines, and WannaCry and NotPetya were effective only because organisations had not applied a patch known for one and two months respectively](https://www.helpnetsecurity.com/2018/11/21/conficker/)
- [On the reliability of infection counts: figures of around nine million were best-effort estimates rather than a precise census, derived from telemetry and sinkhole data and varying by vendor methodology](https://windowsforum.com/threads/conficker-downadup-worm-patch-ms08-067-and-patch-management-lessons.381021/)