Type Network worm
Creator John F. Schoch, Jon A. Hupp
Date Discovered ca. 1979
Place of Origin Palo Alto, California, USA
Source Language BCPL
Platform Alto OS
File Type(s)
Infection Length

Xerparc (the official Virus Encyclopedia name for the Xerox PARC Worms) is a family of worms created by Xerox researchers John F. Schoch and Jon A. Hupp that were intended for various beneficial purposes.


The worm searches for new machines by checking its own local host number and sending its packet to the next highest host number and keeps going up one until it finds an available host. It sends a packet to the machines that it finds to see if they are being used. When it finds an idle machine, it boots it and sends a copy of itself to the new machine. At no point does the worm ever save itself to any disk, staying completely in memory.

The worms on different machines communicate with each other. Each one contains a list of all the other worms. When the worm is finished with the machine, it invokes the standard network boot procedure, which will reload a memory diagnostic program that is normally run on an Alto when it is idle.


All variants presumably had the same spreading techniques and took control of the computer in the same way. The only differences between them are the purposes for which they were created. These are:

  • Existential Worm (the first worm, it does nothing but spread)
  • Billboard Worm
  • Alarm Clock Worm
  • Animation worm
  • Ethernet Diagnostic Worm


As the Xerparc worms were authorised experiments conducted at Xerox's Palo Alto Reasearch Center, what little damage they caused was confined to that location. The facility contained over 100 Alto computers, all of which were presumably infected with a worm at one point.

In an early experiment with a worm, a worm had been intentionally left running overnight to exercise its control mechanisms and was only supposed to use a small number of computers. Upon returning the next day, the researchers found that the worm had crashed dozens of computers. Some machines were located in locked rooms that the researchers had no access to, still running worms looking for new systems. This was remedied with a packet injected into the network whose sole purpose was to tell the worms to stop running.

Other Facts

This is the first program described as a "worm". The creators authored a paper on their experiments with the worm programs, which includes a reference to the Tapeworm of John Brunner's "Shockwave Rider".


John F. Shoch, Jon A. Hupp. The "Worm" Programs-Early Experience with a Distributed Computation. 1982

Unless otherwise stated, the content of this page is licensed under Creative Commons Attribution-NonCommercial-ShareAlike 3.0 License