What is the deadliest computer virus? Five outbreaks compared, and what to do on Windows

Which computer virus is the deadliest? The short answer

No organisation keeps an official list of the deadliest computer viruses, so any ranking is a choice of yardstick. By money, the published estimates put NotPetya (2017) and ILOVEYOU (2000) at about 10 billion US dollars each. By machines, Stuxnet reportedly infected over 200,000 computers and WannaCry more than 300,000. By physical effect, Stuxnet is the one that destroyed equipment. By lives, we found no source that gives a death toll for any of them.

Question

Which computer virus is the deadliest? It is a general question, not a file or a detection name on your PC

Honest answer

There is no official winner. It depends on the yardstick: money, machines, physical damage or lives

Most expensive (published estimates)

NotPetya, above 10 billion US dollars in one White House assessment; ILOVEYOU, about 10 billion in estimates from the 2020s

Most physical

Stuxnet, which made centrifuges at an Iranian site destroy themselves

Most disruptive to health care

WannaCry, which hit NHS hospitals in England and Scotland and caused ambulances to be diverted

Platform

All five are Windows threats. This page gives steps for Windows 11 and 10

A word about the word deadly. A computer virus is code. It becomes dangerous to life only when it stops something that people depend on, such as a hospital system. In the sources we read, WannaCry is the case where health services were turned away from non critical emergencies and ambulances were diverted, but none of them states how many people died because of it. We therefore do not rank by deaths, and you should be wary of any page that does.

Virus, worm, trojan, ransomware: why the word matters

People say virus for every kind of malware, but the five outbreaks here are mostly worms, and one is ransomware in disguise. The type decides how it reaches you and what you do about it.

The five candidates, one by one

Each of these outbreaks is deadly in a different sense. Read them as five different kinds of harm rather than five scores in one contest.

1. 4 May 2000

   ILOVEYOU, the love letter

   A worm that spread by email to everyone in an infected user's address book. The subject read ILOVEYOU and the attachment was named LOVE-LETTER-FOR-YOU.TXT.vbs, which hid a script behind what looked like a text file. Tens of millions of Windows computers were reportedly infected, about 10 percent of the machines on the internet at the time. It overwrote files, forced mail systems to shut down under the volume of messages, and tried to download a trojan meant to steal passwords. Estimates from the 2020s put the damage at about 10 billion US dollars.

2. 26 January 2004

   Mydoom, the fastest email worm

   First seen on 26 January 2004, it posed as a mail transmission error with subject lines such as Error or Mail Transaction Failed. At first it was roughly one in ten email messages and at its peak about one in five. At least 500,000 computers were infected, and for a few hours it slowed overall internet performance by about 10 percent. It opened a backdoor on TCP port 3127 and launched a denial of service attack on the SCO Group. The article we read gives no dollar figure.

3. June 2010

   Stuxnet, the one that broke machines

   Researchers identified it in mid June 2010, though the first variant appeared in June 2009. It targeted Siemens industrial control systems and was aimed at Iran's uranium enrichment at Natanz. It raised and lowered the speed of centrifuge rotors until they damaged themselves, while hiding the changes from monitoring. It spread through infected USB drives and used four zero day Windows vulnerabilities, and it stayed dormant on machines without the targeted Siemens software. Over 200,000 computers were reportedly infected, about 60 percent of them in Iran. Neither the US nor Israel has officially acknowledged responsibility.

4. 12 May 2017

   WannaCry, the hospital stopper

   It used EternalBlue, a Windows file sharing (SMB) exploit that the Shadow Brokers had leaked about a month earlier. Microsoft had shipped the fix, bulletin MS17-010, on 14 March 2017, but many machines were unpatched or unsupported. More than 300,000 computers in about 150 countries were infected. NHS hospitals in England and Scotland were hit, with up to 70,000 devices possibly affected, some services turning away non critical emergencies and ambulances diverted. A researcher registered a hard coded domain that acted as a kill switch and slowed the spread. The US and UK formally blamed North Korea in December 2017, and North Korea denied involvement.

5. 27 June 2017

   NotPetya, the costly wiper

   It looked like ransomware but its encryption was changed so that it could not be reversed, and the single fixed Bitcoin wallet and low 300 dollar fee suggest that damage, not profit, was the goal. It spread through a compromised update of the Ukrainian tax software M.E.Doc, and also used EternalBlue, a modified Mimikatz for passwords and PsExec to move across networks. About 80 percent of the infections were estimated to be in Ukraine, but victims included Maersk, Merck, FedEx and Saint-Gobain. A White House assessment put total damages above 10 billion US dollars. Several governments blamed the Russian GRU's Sandworm group.

Side by side: how they compare on each yardstick

The table below uses only figures from the pages we read. Where a source gave no number, we say so rather than fill the gap.

What we checked on 17 October 2026, and what we could not

There is no website to test and we ran no sample. Our own check was none on a PC: we read five encyclopedia articles and stated their numbers with their limits.

What the deadliest ones did, and what that tells you

Look past the headline numbers and the same few tricks repeat. Each one is something an ordinary user or administrator can answer.

You are very unlikely to meet these exact five, but their descendants and imitations use the same routes. These are the risks, shown by how well they are backed.

• High

  Lost files

  ILOVEYOU overwrote files and NotPetya's damage could not be reversed. Without an offline backup, a file lost this way is gone.

• High

  Stolen passwords

  ILOVEYOU tried to download a password stealing trojan and NotPetya harvested passwords with a modified Mimikatz. One infected PC can expose accounts well beyond that PC.

• High

  A whole network down

  WannaCry and NotPetya spread from machine to machine. In an office or a home with shared drives, one unpatched PC can become many.

• Medium

  A backdoor left behind

  Mydoom opened a backdoor on TCP port 3127, and the source says the backdoors stayed open after the spread stopped. A PC can be reachable by others long after the headline ends.

• Medium

  Paying does not fix it

  WannaCry demanded about 300 dollars in Bitcoin; only 327 payments totalling about 130,634 dollars were made by 14 June 2017. Nothing in our sources shows payment reliably restored files.

• Low

  Fear without infection

  Reading about a deadly virus does not mean you have one. Most people with this worry have nothing; the next chapters help you tell.

How these threats reached people, and how copies reach you today

The routes below come from the five outbreaks. Present day malware uses the same doors, so each one has a plain answer.

1. 1

   An email attachment that looks harmless

   ILOVEYOU used a script file named like a text file, and Mydoom posed as an error message. Today the file is often an Office document, an archive or a link. Open only what you expected, and check that the sender's address matches.

2. 2

   An unpatched Windows PC on a network

   WannaCry spread through the SMB service using a flaw Microsoft fixed in March 2017. A PC that installs Windows updates is not open to that flaw. A PC that no longer gets updates should not be on a network with anything you care about.

3. 3

   A software update from a supplier you trust

   NotPetya spread through a compromised update of Ukrainian tax software. You cannot check every update, but you can keep the number of programs small, remove the ones you do not use, and keep backups.

4. 4

   A USB drive

   Stuxnet crossed networks that were not connected to the internet on infected USB flash drives. Do not plug in a drive you found or were handed by someone you do not know, and turn off autorun habits where you can.

5. 5

   File sharing and pirated software

   Mydoom copied itself into the Kazaa shared folder. Cracks, keygens and shared files remain a common way for malware to spread.

Check your PC if you fear you have one of these

Start by looking, not by deleting. The tools below are built into Windows 11 and 10, and none of them needs a download.

1. 1

   Look at Protection history

   Open Windows Security > Virus & threat protection > Protection history. If Defender found or blocked something, you see the name, the date and the path. Write them down before you click anything.

2. 2

   Check that protection is on

   In Windows Security > Virus & threat protection > Manage settings, confirm that Real-time protection is on. Under Exclusions, look for entries you did not add.

3. 3

   Look at what starts with Windows

   Press Ctrl + Shift + Esc, open Startup apps and look for names you do not know. Switch off what you cannot explain.

4. 4

   Look at running processes

   In Task Manager, open the Processes tab and sort by CPU and memory. Right-click an entry you do not know and choose Open file location. A file in a temporary folder with a random name is worth a closer look.

5. 5

   Check Windows Update

   Open Settings > Windows Update and install everything offered. A PC that is behind on updates is the situation the worms of 2017 relied on.

Clean a Windows 11 or 10 PC you think is infected

Do the steps in order and stop when a scan from outside Windows is clean and nothing returns. We did not run these steps on a live infection; they use the Windows Security menus.

1. 1

   Disconnect first

   Turn off Wi-Fi or unplug the network cable if you think a worm is active. Worms such as WannaCry and NotPetya spread over the network, so a disconnected PC cannot pass it on.

2. 2

   Back up documents

   Copy documents and photos, not programs, to an external drive and unplug it afterwards. Do this before cleaning, in case a step removes something you wanted.

3. 3

   Update Defender and run a full scan

   Open Windows Security > Virus & threat protection > Protection updates > Check for updates. Then go to Scan options, choose Full scan and Scan now. A quick scan can miss files in folders it does not check.

4. 4

   Run a Microsoft Defender Offline scan

   In Scan options choose Microsoft Defender Offline scan and Scan now. The PC restarts and scans from outside the normal Windows session, so save your work first and, if BitLocker is on, make sure you have your recovery key.

5. 5

   Remove programs you do not recognise

   Open Settings > Apps > Installed apps and uninstall software you did not install, starting with the newest.

6. 6

   Install all Windows updates

   Open Settings > Windows Update and install everything offered, then restart. This closes the kind of hole that WannaCry used.

7. 7

   Change passwords from another device

   Email first, then banking, then everything else. Turn on two step sign in and sign out of all sessions in your main accounts.

8. 8

   If nothing works, rebuild Windows

   As a last resort use Settings > System > Recovery > Reset this PC. Resetting wipes your programs, so do it only with a backup of your documents.

If you run a small business or look after other people's PCs

The costly outbreaks hit organisations, not single home PCs. The measures that matter are the ones that stop a worm from crossing a network.

1. 1

   Patch and retire

   WannaCry hit machines that missed a fix published two months earlier or that no longer got fixes. Keep a list of every Windows machine and its update state, and replace the ones that can no longer be updated.

2. 2

   Do not let one account open every door

   NotPetya used stolen passwords and PsExec to move from machine to machine. Give staff ordinary accounts, keep administrator accounts for administrators, and do not reuse one local password on every PC.

3. 3

   Keep backups that a worm cannot reach

   A copy on a drive that stays plugged in can be encrypted or wiped with the rest. Keep one copy offline and test a restore.

4. 4

   Know your suppliers

   The M.E.Doc backdoor sat in a trusted update for at least six weeks before NotPetya. Limit the software your business depends on to what it needs, and ask suppliers how they protect their updates.

5. 5

   Plan for the day it fails

   Hospitals in England and Scotland had to turn away non critical cases during WannaCry. Write down how you would work for a day with no computers, and who you would call.