How a Spanish virus brought Google to Málaga

After 33 years, Bernardo Quintero decided it was time to find the person who changed his life — the anonymous programmer who created a computer virus that had infected his university decades earlier.

The virus, called Virus Málaga, was mostly harmless. But the challenge of defeating it sparked Quintero’s passion for cybersecurity, eventually leading him to found VirusTotal, a startup that Google acquired in 2012. That acquisition brought Google’s flagship European cybersecurity center to Málaga, transforming the Spanish city into a tech hub.

All because of a small malware program created by someone whose identity Quintero had never known. Moved by nostalgia and gratitude, Quintero launched a search earlier this year. He asked Spanish media outlets to amplify his quest for tips. He dove back into the virus’s code, looking for clues his 18-year-old self might have missed. And he eventually solved the mystery, sharing the bittersweet resolution in a LinkedIn post that went viral.

The story begins in 1992, when a young Quintero was prompted by a teacher to create an antivirus for the 2610-byte program that had spread across the computers of Málaga’s Polytechnic School. “That challenge in my first year at university sparked a deep interest in computer viruses and security, and without it my path might have been very different,” Quintero told TechCrunch.

Quintero’s search was aided by his programmer instincts. Earlier this year, he stepped down from his team manager role to “go back to the cave, to the basement of Google.” He didn’t leave the company; instead, he went back to tinkering and experimenting without managerial duties.

That tinkering mindset also led him to reexamine Virus Málaga and look for details he’d missed years earlier. First, he found fragments of a signature, but thanks to another security expert, he discovered a later variant of the virus with a much clearer cue: “KIKESOYYO.” “Kike soy yo” would translate to “I am Kike,” a common nickname for “Enrique.” 

Around the same time, Quintero received a direct message from a man who is now the general digital transformation coordinator for the Spanish city of Cordoba and who claimed he witnessed one of his Polytechnic School classmates create the virus. Many details added up, but one stood out in particular: the man knew that the virus’s hidden message — called a payload, in cybersecurity terms — was a statement condemning the Basque terrorist group ETA, a fact that Quintero had never disclosed.

The tipster then gave Quintero a name — Antonio Astorga — but also shared the news that he had passed away. 

This hit Quintero like a ton of bricks; now, he would never be able to ask Antonio about “Kike.” But he kept following the thread, and the plot twist came from Antonio’s sister, who revealed that his first name was actually Antonio Enrique. To his family, he was Kike.

Cancer took away Antonio Enrique Astorga before Quintero could thank him in person, but the story doesn’t stop here. Quintero’s LinkedIn post sheds new light to the legacy of “a brilliant colleague who deserves to be recognized as a pioneer of cybersecurity in Málaga” — and not just for helping Quintero discover his vocation.

According to his friend, Astorga’s virus had no other goal than spreading his anti-terrorist message and proving himself as a programmer. Mirroring Quintero’s path, Astorga’s interest in IT endured, and he became a computing teacher at a secondary school that named its IT classroom after him in his memory. 

Astorga’s legacy also lives on beyond these walls, and not just through his students. One of his sons, Sergio, is a recent software engineering graduate with an interest in cybersecurity and quantum computing — a meaningful connection for Quintero. “Being able to close that circle now, and to see new generations building on it, is deeply meaningful to me,” Quintero said.

For Quintero, who suspects their paths will cross again, Sergio is “very representative of the talent being formed in Málaga today.” This, in turn, is a result of VirusTotal forming the root of what eventually became the Google Safety Engineering Center (GSEC) and spearheading collaborations with the University of Málaga that made the city a true cybersecurity talent hub.