There is no reliable universal ranking of the most dangerous computer viruses: the answer changes depending on whether you measure spread, disruption, damaged files, or financial loss. The cases below show why several of the best-known “computer viruses” were technically worms or ransomware—and how their effects differed.
What makes malware dangerous?
“Computer virus” is often used casually to mean any malicious software, but the technical distinctions matter. A virus attaches itself to a host program; a worm can spread independently; ransomware encrypts data or otherwise attempts to extort its victims. WannaCry combined ransomware with a worm component, while NotPetya posed as ransomware but is described by government agencies as disruptive malware.
These incidents cannot be ranked fairly by a single damage number. Their estimates come from different sources and use different measures: infection counts, cleanup and repair costs, or broad early loss estimates. The table compares what the cited sources establish, rather than presenting a false leaderboard.
How the major incidents compare
| Incident | How it spread | Main effect and documented reach | Financial impact reported by the cited source | Defensive lesson |
|---|---|---|---|---|
| Morris worm | Worm; propagated independently across networked systems. | Disrupted systems. The FBI says it did not damage or destroy files. | No comparable dollar figure stated in the FBI account. | Malware can cause serious harm through disruption even without deleting files. |
| Melissa | Email-related propagation involving unsolicited attachments. | Disrupted systems and drew attention to the risks of unexpected email attachments. | The FBI reported an estimated $80 million in cleanup and repair costs in 2019; this is not a complete measure of global economic impact. | Be cautious with unexpected attachments. |
| ILOVEYOU | An email attachment, when opened and run, used Outlook address books to send copies. | Could overwrite or replace files and caused broad disruption. | FBI testimony discussed early estimates from $100 million to more than $10 billion, while explicitly noting that the witness had no basis to assess overall loss. These are uncertain early estimates, not an agreed final total. | Do not open and run unexpected attachments. |
| WannaCry | Ransomware with a worm component that exploited Windows SMBv1 vulnerabilities. | Encrypted files and spread rapidly. A 2017 DHS/NCCIC review reported hundreds of thousands of infections in more than 150 countries within days. | No comparable audited dollar-loss figure is stated in the cited fact sheet or review. | Install the MS17-010 security update, isolate infected systems, and maintain backups. |
| NotPetya | Disruptive malware that masqueraded as ransomware. | CISA and partner governments said it caused damage to millions of devices globally; this is not a count of verified individual victims. | No comparable audited dollar-loss figure is stated in the cited advisory. | Keep systems patched and plan for recovery from destructive disruption. |
Why the Morris worm mattered without destroying files
The FBI describes the Morris worm as a major early Internet attack and distinguishes a worm’s independent propagation from a virus’s reliance on a host program. In this case, the harm came from disrupted systems, not file destruction. It is a useful reminder that a malware incident’s seriousness is not measured only by whether data was erased or encrypted.
#1 Best Overall
![Norton 360 Deluxe 2027 Antivirus, 3 Devices, Auto-Renews [Download]](https://m.media-amazon.com/images/I/41qw3FS3qLL._SL160_.jpg)
- ONGOING PROTECTION Download instantly & install protection for 3 PCs, Macs, iOS or Android devices in minutes!
- TOP-PERFORMING VPN Faster speeds, more server locations, and greater connection control to protect your privacy across all your devices, including Smart TVs.
- ADVANCED SCAM PROTECTION Help spot hidden scams online. With the built-in Genie AI assistant, you’ll never wonder if a message or email is suspicious again.
- REAL-TIME PROTECTION Advanced security protects against existing and emerging malware threats, including ransomware and viruses, and it won’t slow down your device performance.
- DARK WEB MONITORING Identity thieves can buy or sell your information on websites and forums. We search the dark web and notify you should your information be found.
Melissa and ILOVEYOU: email helped the malware travel
Melissa and ILOVEYOU both demonstrate how email behavior and address-book connections can help malicious code reach more people. The FBI says Melissa disrupted systems and raised awareness about unsolicited attachments; its 2019 account gives an estimated $80 million for cleanup and repair costs, not a complete global-loss total.
In FBI testimony, ILOVEYOU is described as an attachment that users opened and ran. It used Outlook address books to send copies and could overwrite or replace files. The testimony cites early loss estimates ranging from $100 million to more than $10 billion, but the witness said they had no basis to comment on overall loss. That range should not be treated as a settled damage figure.
Rank #2
- THREAT DETECTION – Stay one step ahead. Suspicious links, risky sites, viruses, and scams, caught automatically before they reach you.
- PERSONAL INFO PROTECTION – Keep your personal info safer. Identity monitoring watches for your exposed info and tells you what to do about it.
- SECURE CONNECTIONS – Just a few easy clicks, and we'll automatically protect your info on public Wi‑Fi, every time you connect.
- GUIDED ACTION – Know what matters and what to do next. Clear alerts and simple guidance make it easy to take action.
- MORE THAN ANTIVIRUS – Scam protection, identity monitoring, VPN, web protection, and antivirus work together to protect you, all in one place.
WannaCry: ransomware that also spread like a worm
WannaCry paired file encryption with worm-like network propagation. CISA describes it as exploiting vulnerabilities in Windows SMBv1, and the 2017 DHS/NCCIC review reported hundreds of thousands of infections in more than 150 countries within days. Those figures describe the scale reported by the agency, not a precise count of every affected person or organization.
CISA’s WannaCry fact sheet says systems with the MS17-010 patch installed were not vulnerable to the exploits used. It also recommends isolating infected systems to prevent additional compromise and identifies backups as a way to support recovery. These measures address different parts of the problem: patching reduces exposure, isolation limits spread, and backups help restore data.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Rank #3
![Norton 360 Deluxe 2027 Antivirus, 5 Devices, Auto-Renews [Download]](https://m.media-amazon.com/images/I/41IYV5zGyCL._SL160_.jpg)
- ONGOING PROTECTION Download instantly & install protection for 5 PCs, Macs, iOS or Android devices in minutes!
- TOP-PERFORMING VPN Faster speeds, more server locations, and greater connection control to protect your privacy across all your devices, including Smart TVs.
- ADVANCED SCAM PROTECTION Help spot hidden scams online. With the built-in Genie AI assistant, you’ll never wonder if a message or email is suspicious again.
- REAL-TIME PROTECTION Advanced security protects against existing and emerging malware threats, including ransomware and viruses, and it won’t slow down your device performance.
- DARK WEB MONITORING Identity thieves can buy or sell your information on websites and forums. We search the dark web and notify you should your information be found.
NotPetya: when ransomware-like behavior was destructive
NotPetya appeared to be ransomware, but CISA and partner governments characterize it as disruptive malware. Their 2022 advisory says it caused damage to millions of devices globally. That wording indicates broad device impact; it should not be read as a verified victim count or converted into a dollar comparison with incidents whose sources report different kinds of costs.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.What these incidents mean for protecting your computer
No single tool guarantees protection. The history of these incidents points to layered habits: reduce exposure, avoid helping malware spread, and make recovery possible if prevention fails.
Quick Recap
Best Value
- THREAT DETECTION – Stay one step ahead. Suspicious links, risky sites, viruses, and scams, caught automatically before they reach you.
- PERSONAL INFO PROTECTION – Keep your personal info safer. Identity monitoring watches for your exposed info and tells you what to do about it.
- SECURE CONNECTIONS – Just a few easy clicks, and we'll automatically protect your info on public Wi‑Fi, every time you connect.
- GUIDED ACTION – Know what matters and what to do next. Clear alerts and simple guidance make it easy to take action.
- MORE THAN ANTIVIRUS – Scam protection, identity monitoring, VPN, web protection, and antivirus work together to protect you, all in one place.
Rank #4
- SPEED-OPTIMIZED, CROSS-PLATFORM PROTECTION: World-class antivirus security and cyber protection for Windows (Windows 7 with Service Pack 1, Windows 8, Windows 8.1, Windows 10, and Windows 11), Mac OS (Yosemite 10.10 or later), iOS (11.2 or later), and Android (5.0 or later). Organize and keep your digital life safe from hackers
- SAFE ONLINE BANKING: A unique, dedicated browser secures your online transactions; Our Total Security product also includes 200MB per day of our new and improved Bitdefender VPN
- ADVANCED THREAT DEFENSE: Real-Time Data Protection, Multi-Layer Malware and Ransomware Protection, Social Network Protection, Game/Movie/Work Modes, Microphone Monitor, Webcam Protection, Anti-Tracker, Phishing, Fraud, and Spam Protection, File Shredder, Parental Controls, and more
- ECO-FRIENDLY PACKAGING: Your product-specific code is printed on a card and shipped inside a protective cardboard sleeve. Simply open packaging and scratch off security ink on the card to reveal your activation code. No more bulky box or hard-to-recycle discs. PLEASE NOTE: Product packaging may vary from the images shown, however the product is the same.
- Keep supported operating systems and software updated. Security patches matter; in the WannaCry case, CISA specifically identified MS17-010 as a patch that prevented vulnerability to the exploits used.
- Treat unexpected attachments cautiously. Do not open or run an attachment simply because it appears to come from someone you know; an address book can be used to send copies of malware.
- Keep backups that an infected computer cannot readily alter. CISA identifies backups as a recovery path. An offline or otherwise protected backup can help preserve a usable copy if malware encrypts or damages files.
- Isolate a suspected infected device. CISA recommends isolating infected systems in the WannaCry context to prevent additional compromise. Follow your organization’s incident-response process if the device is managed by work or school.
- Use antivirus or endpoint protection as one layer, not a guarantee. It does not replace updates, cautious attachment handling, or recoverable backups.
Sources
- FBI: The Morris Worm
- FBI: Melissa Virus 20th Anniversary
- FBI testimony on the ILOVEYOU virus
- CISA: WannaCry Ransomware
- DHS/NCCIC: 2017 Year in Review
- CISA and partner governments: Russian State-Sponsored and Criminal Cyber Threats to Critical Infrastructure
- CISA: #StopRansomware Guide
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
