Lead
Bernardo Quintero traced a small 1992 university program known as Virus Málaga back to its author this year, closing a three-decade mystery that helped shape his career in cybersecurity. The discovery linked an anonymous teenage programmer to a chain of events that led Quintero to found VirusTotal, a startup Google acquired in 2012. That acquisition later anchored Google’s Safety Engineering Center (GSEC) in Málaga and helped turn the city into a cybersecurity talent hub. The recent identification of the author — Antonio Enrique “Kike” Astorga, who died before Quintero could thank him — added a personal coda to the technical origin story.
Key Takeaways
- Virus Málaga was a 2,610‑byte program that circulated at Málaga’s Polytechnic School in 1992 and prompted a young Bernardo Quintero to build an early antivirus.
- Quintero’s early work on that virus influenced his career trajectory and later led him to co-found VirusTotal, acquired by Google in 2012.
- In 2025 Quintero reopened the case, analysing variants and a signature string “KIKESOYYO,” which pointed toward the nickname “Kike” (short for Enrique).
- A tip from a former classmate identified the likely author as Antonio Astorga; his sister confirmed his given name was Antonio Enrique and that he was called Kike by family.
- Astorga became a computing teacher; a local school named its IT classroom after him, and his son Sergio is a recent software engineering graduate focused on cybersecurity.
- VirusTotal’s presence and subsequent Google investment helped establish the Google Safety Engineering Center (GSEC) in Málaga, strengthening ties with the University of Málaga.
- The discovery has symbolic value for local talent pipelines and highlights how small early incidents can ripple into lasting institutional change.
Background
In 1992 a compact program later dubbed Virus Málaga spread across machines at the Polytechnic School of Málaga. The file measured 2,610 bytes and, while largely harmless in payload, presented a technical puzzle that became a learning moment for students exposed to the problem. A teacher encouraged an 18‑year‑old Bernardo Quintero to develop an antivirus, a task that ignited his interest in malware analysis and defensive tooling.
Quintero’s early engagement with malware analysis eventually led him to found VirusTotal, a malware scanning and analysis service that aggregated multiple antivirus engines and community contributions. Google acquired VirusTotal in 2012; over time its engineering presence anchored collaborations with local universities and contributed to the creation of the Google Safety Engineering Center in Málaga. Those institutional links have helped to build a local cybersecurity ecosystem that trains and retains talent in the region.
Main Event
This year Quintero reopened his search for the person who authored Virus Málaga. He publicly solicited tips through Spanish media and revisited the virus code with fresh attention to detail. Initial fragments of a signature led to discovery of a later variant containing a clearer marker: “KIKESOYYO,” which Quintero and colleagues interpreted as an informal Spanish phrase meaning “I am Kike.”
Quintero also received a direct message from a man who now serves as general digital transformation coordinator for Córdoba; the sender said he had witnessed a Polytechnic School classmate creating the virus. The tipster linked an identity to the code: Antonio Astorga — a name later clarified by family as Antonio Enrique Astorga, commonly called Kike. The tipster added a striking detail: the virus’s hidden payload reportedly carried an anti‑ETA statement, which Quintero had not previously publicised.
The trail took a poignantly human turn when the tipster disclosed that Astorga had died of cancer. Quintero’s later contact with Astorga’s sister confirmed the full given name and nickname, and a friend said Astorga went on to teach computing at a secondary school that later named its IT room in his memory. One of Astorga’s sons, Sergio, is now beginning a technology career with interest in cybersecurity and quantum computing — a symbolic link between past and present local talent.
Quintero also made an internal shift at Google earlier in the year, stepping down from a management role to return to hands‑on technical work. He described the move as “going back to the cave” — a period allowing him to tinker, reexamine old leads, and ultimately close the loop on a decades‑old question about the origin of Virus Málaga.
Analysis & Implications
At face value this is a personal story about mentorship, curiosity and closure. But the implications extend beyond the individuals: an early classroom challenge catalysed a sequence of events that seeded a company (VirusTotal), a major acquisition (Google, 2012), and an institutional engineering presence that today supports training and jobs in Málaga. That chain illustrates how localized early incidents can have outsized impact on regional innovation ecosystems.
For Málaga, the narrative becomes part of civic identity for digital skills. The city’s partnership with Google and the University of Málaga helps create internships, research projects and hiring pipelines that retain graduates locally. These ties reduce brain‑drain pressure and can make Málaga more competitive in cybersecurity research and services — fields of growing public‑ and private‑sector demand.
There are also ethical and pedagogical lessons. The original virus was described as mostly harmless with an ideological payload; educators and technologists must balance curiosity‑driven experimentation with responsible teaching about the social consequences of code. The episode underscores the value of directing youthful technical energy into constructive pathways — research, defensive tooling, and formal education — rather than harmful experimentation.
Finally, the human element — a deceased author, family recognition, and a son entering tech — highlights how technical legacies are lived and transmitted. The transition from an anonymous experimenter to a locally honoured teacher shows how communities can reinterpret early missteps as foundations for positive institutional outcomes.
Comparison & Data
| Year | Event | Significance |
|---|---|---|
| 1992 | Virus Málaga circulates at Polytechnic School | Prompted student antivirus work and introduced Quintero to malware analysis |
| 2012 | Google acquires VirusTotal | Provided resources and platform that later led to GSEC presence |
| 2025 | Quintero identifies author as Antonio Enrique Astorga | Closed a decades‑long mystery and highlighted local legacy |
The table lays out discrete milestones that link a classroom incident to institutional outcomes over roughly three decades. While hard numbers on hires or economic impact tied specifically to GSEC are not publicly enumerated in this report, the qualitative chain—from student project to industry center—maps a clear causal narrative that stakeholders in other regions may study when building local tech clusters.
Reactions & Quotes
Quintero framed the virus as a formative academic challenge that shaped his career direction; his public reflections have drawn attention in Spain and among cybersecurity professionals internationally.
“That challenge in my first year at university sparked a deep interest in computer viruses and security, and without it my path might have been very different.”
Bernardo Quintero (as quoted to TechCrunch)
Friends and family of Astorga have emphasized his later role as an educator and local contributor to computing training.
“He only wanted to show he could program and to leave a statement; later he became a teacher and people remember him for that.”
Friend of Antonio Enrique Astorga (reported)
Local reactions have mixed nostalgia and forward‑looking optimism: recognition of a complex past combined with pride that the city now supports new generations of cybersecurity talent.
Unconfirmed
- The claim that the virus’s payload was explicitly intended as an anti‑ETA political statement is reported via a tipster and has not been independently verified with archival proof of intent.
- Details about the exact motivations of Antonio Enrique Astorga at the time of writing the virus — whether seeking recognition, protest, or technical challenge — remain based on anecdote rather than contemporaneous documentation.
- The direct causal weight of Virus Málaga (versus other factors) in the eventual decision by Google to establish a long‑term engineering center in Málaga cannot be quantified from available public records.
Bottom Line
A small, mostly innocuous university virus from 1992 helped set a human and technical chain that ultimately shaped a city’s cybersecurity profile. The thread from classroom exercise to global company acquisition to local engineering hub shows how formative experiences can propagate through careers and institutions for decades.
Quintero’s identification of Antonio Enrique Astorga turns an anonymous technical anecdote into a human story about mentorship, memory and local pride. For Málaga, the episode reinforces the importance of investing in education and industry partnerships that channel technical curiosity into constructive, community‑beneficial outcomes.