The Pikachu virus may be, according to people who know about these things, the first computer virus targeted at children. It was discovered on this day back in 2000, and the vector was an email with the subject line “Pikachu Pokemon”. It contained the body text “Pikachu is your friend” and an attachment called ‘PikachuPokemon.exe’. Those who opened the executable saw an image of a bouncing Pikachu and text stating “Between millions of people around the world I found you. Don’t forget to remember this day every time MY FRIEND.”
The next time this user rebooted their computer, the worm would attempt to delete essential system directories and, if they used Outlook, email the Pikachu virus to everyone in their address book.
2000: The Pikachu virus began spreading. It is believed to be the first virus targeting children. pic.twitter.com/sPowfQvanq
— Today In Infosec (@todayininfosec) June 29, 2017
The Symantec entry lists the virus under the name W32.Pokey.Worm and classifies it as ‘Risk Level 1: Very Low’. This may be because, while the worm’s payload was intended to delete Windows directories when the affected PC was rebooted, it has an unusual touch that may reflect a low-level pang of conscience. Before it deletes anything, it asks the user for permission to do it. This is often given as the reason for the worm not propagating to the extent it could have (and the reason for Symantec’s low threat rating).
You can see it in action here:
Alternative names for the Pikachu virus include the Poké Virus, I-Worm.Pikachu, Pokey.bat, and Pokey. Despite its malign intent and use of a popular children’s brand, it was overshadowed at the time by the Love Bug — that one where the subject line was ‘ILOVEYOU’ — which was much more aggressive and eventually infected, by some estimates, 50 million PCs (there’s a fascinating article about the Love Bug here).
Nevertheless the Pikachu virus stands as the first known example of malware aimed specifically at children, using a much-loved character to try and take advantage of their curiosity and naivety. That little detail, the fact it asks the user before deleting any directories, is attributed by some observers (who know much more than me about these things) to incompetence on the part of the creator. We’ll never know but I prefer to think that, as the villain prepared to unleash this on the world, some yet-human part of their shrivelled soul realised what they were doing, and added an escape route.
Maybe I’m the naive one. Whatever the truth we can give thanks, at least, that the Pikachu virus was not very effective.