============================================================================ PC Viruses in the Wild - March 1, 1994 ============================================================================ This is a cooperative listing of viruses reported as being in the wild by 16 virus information professionals. The basis for these reports are virus incidents where a sample was received, and positively identified by the participant. Rumors and unverified reports have been excluded. The list should not be considered a list of "currently common" viruses however. No provision is made for commonness. A currency basis for the list has been set. Reports date from September of 1992 to the present. An additional list, the FreqList, gives details on the most frequently reported viruses. It also gives more details on aliases. This data indicates only "which" viruses have been found in the wild. ============================================================================ The section below gives the names of participants, along with their organization, antivirus product (if any), and geographic location. Key Participant Organization Product Location ============================================================================ As Alan Solomon S&S Int'l Toolkit UK Dc Dave Chess IBM IBM AntiVirus USA Ek Eugene Kaspersky KAMI AVP Russia Fb Fernando Bonsembiante Virus Report None Argentina Fs Fridrik Skulason Frisk Int'l F-Prot Iceland Gj Glenn Jordan Datawatch VirexPC USA Jw Joe Wells Symantec NAV USA Pd Paul Ducklin CSIR Virus Lab None So Africa Pp Padgett Peterson Hobbyist DiskSecure USA Rf Richard Ford Virus Bulletin None UK Rh Richard Head Jade Corp None Japan Rr Roger Riordan CYBEC VET Australia Sg Shimon Gruper EliaShim ViruSafe Israel Vb Vesselin Bontchev U of Hamburg None Germany Ws Wolfgang Stiller Stiller Research Integ Master USA Yr Yuval Rakavi BRM Untouchable Israel ============================================================================ The first chart is based on two or more participants reporting a virus. Therefore, these viruses are probably more geographically scattered. CARO Name of Virus AsDcEkFbFsGjJwPdPpRfRhRrSgVbWsYr Alias(es) ============================================================================ AntiEXE.................| . . . . x . x . . . . . . x . x | D3, Newbug Athens..................| . . . . x . x . . . . . . . . . | Trajector Boot-437................| . . . . . . x . . . . . . . . x | Barrotes.A..............| x . . . . . x x . . . . . . . . | Barrotos Brasil..................| . . . . . . x . x . . . . . . . | Butterfly...............| . . . . . . x . . . . . . x . x | Cascade.1701.A..........| x x . x x . . . . x x . x x . . | 1701 Cascade.1704.A..........| x x x . x . x . . . . . x . . x | 1704 Changsha................| . . . . . . x . . . x x . . . . | Centry Chinese Fish............| x x . . x x x x . . . x . . . x | Fish Boot CPM.....................| . . . . . . x . x . . . . . . . | Chile,Meirda Dark_Avenger.1800.A.....| x x . x x x x . . x x x . . x x | Eddie Dark_Avenger.2100.SI.A..| x . . . . . x . . . . . . . . . | V2100 Datalock.920............| x x . . . . x . . . . . x . . x | V920 Dir-II.A................| x x x x x . x x . x x x x x x x | Creeping Death Disk_Killer.A...........| x . x . . . x . x x . . x . . . | Ogre Even_Beeper.............| x x . . . . . . . . . . . . . . | EXE_Bug.A...............| x . . . . . x x . x . . x . x . | CMOS Killer EXE_Bug.C...............| . . . . . . . x . . . . x . x . | Fichv.2_1...............| x . . . x . . . . . . . x . . x | 905,CHV 2.1 Filler..................| . . . . . x x . . . . . . . . . | Flip.2153.A.............| x x . x x . x . . x x . x . . . | Omicron 1 Flip.2343...............| x . . . x . . . . . . . . . . . | Omicron 2 Form....................| x x . x x x x . x x x . x x x x | Form 18 Freddy_2................| . . . . x . x . . . . . . . . . | Frodo.Frodo.A...........| x x . x x . x . . . x x x . . x | 100 Year,4096,4k Ginger..................| . . . . . . x . . . . x . . . . | Gingerbread Man Green Caterpillar.......| x x . . x x x . . x x x x . x x | Find,1591,1575 Helloween.1376..........| x . . . . . x . . x x x . . x x | Hell-1182 Jerusalem.1244..........| x x . . . . . . . . . . . . . . | 1244 Jerusalem.1808.Standard.| x x . x x x x x x x x . x . x x | 1813,Israeli Jerusalem.Anticad.4096.B| x . . . x . . . . . . . x . . . | Invader,Mozart Jerusalem.Fu_Manchu.....| x . . . . . x . . . . . x . . . | 2080,2086 Jerusalem.Mummy.2_1.....| x . . . x . . x . . x . x . . . | PC Mummy Jerusalem.Sunday.A......| . . . . . . . x . . x . . . . x | Sunday Jerusalem.Zerotime.Austr| x x . . . . . . . . . x x . x x | Slow Joshi.A.................| x x . . x x x . x x x x x . x . | Kampana.3700:Boot.......| x x . x x x x . . x x . . . x . | Telecom,Campana Keypress.1232.A.........| x x . . . . . x . x x x x . x x | Turku,Twins Liberty.................| . x . . x . x . . x x . . . x x | Mystic,Magic Maltese Amoeba..........| x x . . x . x . x x . . x . x x | Grain of Sand Music_Bug...............| . . . . x x . . x . . . . . x . | Necros..................| x . . . . . x . . . . . . . . . | Gnose,Irish3 NJH-LBC.................| x . . . . . . . . . . . . . . x | Korea Boot No_Frills.Dudley........| x . . . . . . . . . . x . . . . | Oi Dudley No_Frills.No_Frills.....| . . . . . . x . . . . x . . . . | Nomenklatura............| x x . . . . . . . . . . . . . . | Nomen November_17th.800.......| . . . . . . x . . x . . . . . . | Jan800, 800 November_17th.855.A.....| x x . . x . x . . . . . . . . . | V855 NPox.963.A..............| . . . . x . x . . . . . . . . x | Evil Genius Ontario.1024............| . x . . . . . . . . . x x . . . | SBC,1024 Parity_Boot.B...........| x . . . . . x x . x x . . x . . | Generic 1 Ping_Pong.B.............| x x . x . . . . . x . . x . x . | Italian Predator.2448...........| . . . . x . x . . . . . . . . . | 2448 Print_Screen............| x x . . . . x . . . . . . . . x | India,PrtSc Quit.A..................| x x . . . . . . . . . . . . . . | 555,Dutch Quox....................| . x . . x . x . . . . . . . . . | Stealth Ripper..................| x x . . x . x . . . . . . . . . | Jack the Ripper Screaming_Fist.696......| x x . . . x x . . . . . . . x . | Fist 2,Scream 2 Sleepwalker.............| . . . . . . x . . . . x . . . . | Stealth.B...............| . x . . . . x . x . . . . . . . | NOPS,STB Stoned.16...............| x x . . . . x . . . . . . . . x | Brunswick,Stoned 3 Stoned.Azusa............| x x . . x . x x x . x x x . x . | Hong Kong Stoned.Empire.Monkey....| . . . . x x x . x . . x . x x . | Monkey Stoned.Flame............| . . . . . . x . . . . x . x . . | Stoned(3C) Stoned.June_4th.........| x . . . . x x . . . x x . x x x | Bloody!,Beijing Stoned.Lzr..............| . . . . x . x . . . . . . . . x | Stoned.Whit,Lisa 2 Stoned.Manitoba.........| . . . . x . x . . . . . . . . . | Stonehenge Stoned.Michelangelo.....| x x x x x x x x x x x x x x x . | March 6 Stoned.NoINT............| x x . . x x x x . x . x . . x . | Stoned.NOP..............| . . . . . . x . . . . . . . x . | NOP Stoned.Standard.B.......| x . x x x x x x x x x x x x x . | New Zealand Stoned.Swedish_Disaster.| x . . . . x . . . . . . . . . . | Stoned.W-Boot...........| . . . . . . x . . . . x . . . x | W-Boot Stardot.789.............| . x . . . . x . . . . . . . . . | 805,Dot-789 SVC.3103................| x . x . . . x . . . x . x . . . | SVC 5.0 Swiss_Phoenix...........| . . . . . . x . . . . . . . . x | Tequila.................| x x . . x . x x . x x . x x x x | Tremor..................| . . . . x . . . . x . . . x x . | V-Sign..................| x x . . x x x . . x x x x . x . | Cansu,Sigalit Vacsina.TP-05...........| x x . . x x x . . x x . . . x . | RCE-1206 Vacsina.TP-16...........| x x . . x . . . . . . . . . . . | TP16VIR Vienna.648.Reboot.......| x x x . . . . . . . . . . . . . | DOS-62 WXYC....................| . x . . . . x . . . . . . . . . | Yankee Doodle.TP-39.....| x . . . x . . . . . . . . . . . | Doodle,RCE-2772 Yankee Doodle.TP-44.A...| x . x . x . x . . x x . . x . x | Doodle,RCE-2885 Yankee Doodle.XPEH.4928.| . . . . x . . . . . . . . . . x | Micropox Yeke.1076...............| . x . . . . x . . . . . . . . . | ============================================================================ The second chart is based on a single participant noting more than one infection site and may signify limited regional virus outbreaks. CARO Name of Virus AsDcEkFbFsGjJwPdPpRfRhRrSgVbWsYr Alias(es) ============================================================================ 10_Past_3.748...........| . . . . . . . x . . . . . . . . | BootEXE.................| . . . . . . . . . x . . . . . . | BFD-451 Brain...................| . . . . . . . . x . . . . . . . | Pakistani Cascade.1701.G..........| . . . . . . . . . . . . . x . . | 1701 Coffeeshop:MtE_090......| . . . . . . . x . . . . . . . . | Darth_Vader.3.A.........| . . . . . . . . . . . . . . x . | Datalock.828............| . . . . . . . . . . . . . . . x | Den_Zuko.A..............| x . . . . . . . . . . . . . . . | Den Zuk DosHunter...............| . x . . . . . . . . . . . . . . | Emmie.3097..............| . . . . . . . . . . . . . . . x | EXE_Bug.D...............| . . . . . . x . . . . . . . . . | EXE_Engine..............| . . . . . . . . . . . . . x . . | Grower..................| . . . . . . x . . . . . . . . . | V270x,268+ Hafenstrasse............| . . . . . . . . . . . . . x . . | Hafen Hi......................| . . . . . . . . . . . . . . . x | Hi.460 Japanese_Xmas...........| . . . . . . . . . . x . . . . . | Xmas in Japan Jerusalem.1808.CT.......| . x . . . . . . . . . . . . . . | Capt Trips Jerusalem.1808.Null.....| . x . . . . . . . . . . . . . . | Jerusalem.Carfield......| x . . . . . . . . . . . . . . . | Jerusalem.Moctezuma.....| . x . . . . . . . . . . . . . . | Jerusalem.Mummy.1_2.....| . . . . . . . x . . . . . . . . | Jerusalem.Sunday.II.....| . x . . . . . . . . . . . . . . | Sunday 2 Joshi.B.................| . x . . . . . . . . . . . . . . | Jumper..................| . . . . . . . . . . . . . . . x | Kampana.Galicia:Boot....| . . . . . . x . . . . . . . . . | Telecom,Drug Keypress.1744...........| . . . . . . . . . . . . . . . x | Little Brother.307......| . . . . x . . . . . . . . . . . | Lyceum.1788.............| . . x . . . . . . . . . . . . . | Lycee MacGyver................| . . . . . . x . . . . . . . . . | Shoo MISiS...................| . . . . . . . . . . . . . . . x | Zharinov,NIKA Murphy.Smack.1841.......| . . . . . . x . . . . . . . . . | Smack Necropolis..............| . . . . . . . . . . . . . . . x | 1963 Number_of_the_Beast.....| . . . x . . . . . . . . . . . . | 512,666 Parity_Boot.A...........| . . . . . . . . . . . . . . x . | QRry ...................| . . . . . . x . . . . . . . . . | Query,Quarry Sat_Bug.................| . . . . . . x . . . . . . . . . | Satan Bug Screaming_Fist.NuWay....| . . . . . . x . . . . . . . . . | Sticky Stinkfoot...............| . . . . . . . x . . . . . . . . | Stoned.Bunny.A..........| . . . . . . . x . . . . . . x . | Stoned.Dinamo...........| . . . . . . . . . . . . . . . x | Stoned.Michelangelo.K...| . . . . . . . . . . . . . . . x | Stoned.Empire.In_Love...| . . . . . . x . . . . . . . . . | SVC.2936................| . . . . . . x . . . . . . . . . | Stoned.Empire.Int_10....| . . . . . . . . x . . . . . . . | Swiss_Boot..............| . . . . x . . . . . . . . . . . | Swiss Army Syslock.Syslock.A.......| x . . . . . . . . . . . . . . . | Vmem....................| . . . . . . . . . . . . . . . x | Voronezh.1600...........| . . x . . . . . . . . . . . . . | RCE-1600 Yale....................| . x . . . . . . . . . . . . . . | Alameda ============================================================================ Release Notes: ============================================================================ The collation of this material is done by Joe Wells, Virus Specialist at Symantec, Peter Norton Group, who is solely responsible for its contents. The material presented is implicitly copyrighted under various laws, but may be freely quoted or cited. However, its source and cooperative nature should be duly referenced. Other antivirus product developers are invited to participate in the list. If you wish to do so, please contact me. ============================================================================ The WILDList by Joe Wells -- jwells@symantec.com -- 70750,3457 -- Vol2.03x ============================================================================