============================================================================ PC Viruses in the Wild - June 10, 1995 ============================================================================ This is a cooperative listing of viruses reported as being in the wild by many virus information professionals. The basis for the reports are virus incidents where a sample was received, and positively identified by the participant. Rumors and unverified reports have been excluded. The list should not be considered a list of "currently common" viruses however. No provision is made for commonness. A currency basis for the list has been set. Viruses not reported for over a year are removed. This data indicates only "which" viruses have been found in the wild. ============================================================================ The section below gives the names of participants, along with their geographic location, organization, and antivirus product (if any). The locations with an asterisk (*) note that the reports are regional, all others being international or global. Key Participant *Location Organization Product ============================================================================ An Anthony Naggs *So Africa CSIR Virus Lab VPS Cs Christian Schmid *Austria DataPROT Linz F-Prot Dg Dmitry Gryaznov UK S&S Int'l Toolkit Ek Eugene Kaspersky *Russia KAMI AVP Fb Fernando Bonsembiante *Argentina Virus Report None Fs Fridrik Skulason Iceland Frisk Int'l F-Prot Gj Glenn Jordan USA Datawatch VirexPC Iw Ian Whalley UK Virus Bulletin None Jk Jimmy Kuo USA McAfee ViruScan Jw Joe Wells USA IBM IBM AntiVirus Ls Luca Sambucci *Italy/Swiz. Gruppo Editoriale None Mh Mikko Hypponen *Finland Data Felows F-Prot Ms Marek Sell *Poland APEXIM MkS_vir Oh Omar Herrera *Mexico Escuadron AV Aguila AV Pp Padgett Peterson USA Hobbyist DiskSecure Rh Richard Head *Japan Jade Corp Scan Vakzin Rr Roger Riordan Australia CYBEC VET Rt Roger Thompson USA Thompson Network Doctor Rv Robert Vibert *Portugal RSVP None Sc Shane Coursen USA Symantec NAV Sg Shimon Gruper *Israel EliaShim ViruSafe Vb Vesselin Bontchev *Germany U of Hamburg None Ws Wolfgang Stiller USA Stiller Research Integ Master Yr Yuval Rakavi Israel BRM Untouchable ============================================================================ The people below will be future participants in the WildList. ============================================================================ Ad Allan Dyer *Hong Kong Yui Kee Co. Ltd. Cm Clyde Meli *Malta University of Malta Fl Ferenc Leitold *Hungary Hunix Ltd. Gp Gabriel Pislaru *Romania SoftWin Lc Lucian Caric *Croatia Bug Computer Magazine Ml Mikael Larsson *Sweden QA Informatik Nb Neville Bulsara *India Quantum System Software Pb Pavel Baudis *Czech Rep Alwil Software Pl Pascal Loitner *France Rf Richard Ford USA NCSA ============================================================================ This main list includes viruses reported by multiple participants. CARO Name of Virus [ Alias(es) ] Reported by: ============================================================================ 5Lo......................[...............] FsMh Anticad.4096.A...........[Plastique......] JkVb Anticad.4096.B...........[Invader........] DgFsJkSg AntiCMOS.A...............[Lenart.........] DgFsGjIwJkJwMhRhRfRtScVbWsYr AntiEXE.A................[D3,Newbug......] AnDgFsGjIwJkJwMhRfRtScVbWsYr Arianna.3375.............[...............] IwLs Avispa.D.................[...............] JkJwRtSc BackFormat.A.............[Backform.......] JkMhYr Baclab...................[...............] JkPpRtSc Barrotes.1310.A..........[Barrotos.......] DgJkRvSc Boot-437.................[...............] FsGjJkJwRhRtScWsYr BootEXE.451..............[BFD-451........] FsIwJkMh Brasil...................[...............] PpSc Butterfly.Butterfly......[...............] VbYr Cascade.1701.A...........[1701...........] DgFbFsGjIwJkJwLsMhRfRtSgVbWs Cascade.1704.A...........[1704...........] DgEkFsJwRtScSgVb Changsha.A...............[Centry.........] RfRrRt Chaos.1241...............[...............] JkRrYr Chill....................[Chill Touch....] JkRtSc Chinese_Fish.............[Fish Boot......] DgFsGjJkRrRtVbYr Civil_Defence.6672.......[CDV 3.3........] AnJw Coffeeshop:MtE...........[...............] AnJk CPW.1527.................[Mediera,Mierda.] DgJkPpSc Crazy_Boot...............[...............] DgJkJwRhSc DA_Boys..................[...............] JkRtWs Dark_Avenger.1800.A......[Eddie..........] DgFbFsGjIwJwLsRfRrWs Datalock.920.A...........[V920...........] DgJwLsSgYr DelWin.1759..............[...............] JwVb Den_Zuko.2.A.............[Den Zuk........] DgRt Die_Hard.................[Wix............] AnIwJkJwRtScVbWs Dir-II.A.................[Creeping Death.] AnDgEkFbFsIwJkJwOhRfRrScSgVbWsYr Disk_Killer.1_00.........[Ogre...........] DgEkIwPpSg Espejo...................[Stakka,IFE.....] JkJwRtSc EXE_Bug.A................[CMOS Killer....] AnDgFsIwJkRtScSgWs EXE_Bug.C................[...............] AnRtSgWs EXE_Bug.Hooker...........[...............] AnRt Fairz....................[Khobar.........] JkMh Fat_Avenger..............[...............] JwRr Fichv.2_1................[905,CHV 2.1....] DgFsSgVb Finnish_Sprayer..........[...............] FsMhSc Flame....................[Stamford.......] JkJwRrScVbYr Flip.2153.A..............[Omicron........] DgFbFsIwJkJwLsRhRfScSgWsYr Flip.2343................[Omicron 2......] DgFsLsRv Form.A...................[Form 18........] CsDgFbFsGjIwJkJwLsMhPpRfRtRvScSg (Form.A continued) VbWsYr Form.D...................[Form May.......] FsJwRtScYr Frankenstein.............[Frank..........] DgJk Freddy_Krueger...........[Freddy 2.......] FsJkScWsYr Frodo.Frodo.A............[4096,100 Year..] DgFbFsJkJwRfRrSgVbYr Galicia..................[Telecom........] JkRtSc Ginger...................[Gingerbread....] JkRrSc GoldBug..................[...............] DgJkIwMh Green_Caterpillar.1575...[Find,1591,1575.] DgFsGjIwJkJwLsRfRrRtScSgVbWs Hafenstrasse.*...........[Hafen..........] JkVb Helloween.1376.A.........[1376...........] DgIwJkJwRfRrScWsYr Hi.460...................[Hi.............] JkYr Hidenowt.................[...............] DgIwJkRhSc HLLC.Even_Beeper.B.......[...............] DgJwWs Ibex.....................[Seven_Boot.....] JwSc J&M......................[Jimi.Jimmy.....] JkJwRfVb Jerusalem.1244...........[1244...........] DgLs Jerusalem.1808.Standard..[1808,Israeli...] AnDgFbFsGjIwJkJwLsPpRfRtScSgWsYr Jerusalem.Mummy.2_1.A....[PC Mummy.......] AnDgFsRfRtSg Jerusalem.Sunday.A.......[Sunday.........] AnJkRfRt Jerusalem.Zero_Time.Aust.[Slow...........] DgJkJwRhRrRtSgWs Jihuu.686................[...............] FsMh Joshi.A..................[...............] DgFsGjIwJkJwPpRfRrRtScSgVbWsYr Jumper.A.................[French Boot....] DgFsGjJwRtScVbWsYr Jumper.B.................[SillyBop.......] DgMhRhVb Junkie...................[...............] CsFsIwJkJwLsMhRhRrRtVbWsYr Kampana.A................[AntiTel,Telecom] DgFbFsGjIwJkJwMhRhRfRtRvScWs Kaos4....................[...............] AnFsJkMhSc Keypress.1232.A..........[Turku,Twins....] DgIwJwRfRrRtSgWsYr Leandro..................[...............] JkJwRtSc Lemming..................[...............] RrSc Liberty.2857.A...........[Mystic,Magic...] FsIwJwRhRfRtWsYr Little_Brother.307.......[...............] FsJk Little_Red...............[Red Book.......] AnGjJkJwRhRtSc MacGyver.2803............[Shoo...........] AnJk Maltese Amoeba...........[Grain of Sand..] AnDgFsIwJkJwPpRtSgWsYr Mange_Tout.1099..........[...............] DgJkMhRf Markt.1533...............[Werbe..........] DgJk MIREA.1788...............[Lyceum,Lycee...] EkJk Music_Bug................[...............] FsGjJkPpWs Necros...................[Gnose,Irish3...] DgJk Neuroquila...............[Havoc..........] DgIwJkWs NJH2LBC.A................[Korea Boot.....] DgJkYr No_Frills.Dudley.........[Oi Dudley......] DgJkRrRt No_Frills.No_Frills.843..[...............] JkRrSc Nomenklatura.A...........[Nomen..........] DgJkJw November_17th.800.A......[Jan1,800.......] LsSc November_17th.855.A......[V855...........] DgFsJkJwLsRtSc NPox.963.A...............[Evil Genius....] FsSc NYB......................[B1.............] AnDgEkFsGjJkJwLsMhRfRtScVbWsYr One_Half.................[Dis,Free Love..] CsDgEkIwJkJwLsRtScVbWs Ontario.1024.............[SBC,1024.......] JkJwRrSg Parity_Boot.B............[Generic 1......] AnCsDgFsGjIwJkJwMhRhRfRtRvScVb Pathogen:SMEG.0_1........[...............] DgIwJkWs Peter....................[Peter II.......] JwRhJkRf Ping_Pong.B..............[Italian........] DgFbIwJkJwLsSgWsYr Predator.2448............[2448...........] FsSc Print_Screen_Boot.A......[India,PrnSn....] DgJwScYr QRry.....................[Query,Essex....] JkJwSc Queeg:SMEG.0_1...........[...............] DgJk Quox.....................[Stealth 2......] FsJkJwRhRtSc Riihi....................[...............] FsMh Ripper...................[Jack Ripper....] AnCsDgFsGjJkJwMhRhRfRtScVbWs Russian_Flag.............[...............] AnDg Sampo....................[Turbo..........] DgFsGjIwJkJwMhRhRfRtScVbWs Sat_Bug.Natas............[Satan..........] DgFsJwMhJkRtRvScVbWs Sat_Bug.Sat_Bug..........[Satan Bug......] JkJwYr Sayha....................[...............] ScYr Screaming_Fist.II.696....[Fist 2,Scream 2] DgGjJkJwRtScWs Sibylle..................[...............] DgJw Sleep_Walker.............[...............] JkRrSc Stardot.789.A............[805............] JwLsSc Stealth_Boot.B...........[AMSE NopB......] GjIwJkJwPpRhRtScVb Stealth_Boot.C...........[AMSE NopB2.....] GjJkJwRtVbYr Stoned.16.A..............[Brunswick......] DgJwScYr Stoned.Angelina..........[...............] CsDgIwJkJwMhRvSc Stoned.Azusa.A...........[Hong Kong......] AnDgFsGjJkJwPpRfRrRtScSgWsYr Stoned.Bravo.............[...............] AnJk Stoned.Bunny.A...........[...............] AnWs Stoned.Dinamo.*..........[...............] RtScYr Stoned.Empire.Int_10.B...[...............] JkPpRt Stoned.Empire.Monkey.A...[Monkey.........] IwJkJwRrRtSc Stoned.Empire.Monkey.B...[Monkey 2.......] AnDgFsGjIwJkJwMhPpRhRfRrRtScVbWs Stoned.June_4th.A........[Bloody!,Beijing] DgGjJkRfRrScVbWsYr Stoned.Kiev..............[...............] EkJkRt Stoned.Lzr...............[Stoned.Whit....] FsGjIwJkJwMhRtScYr Stoned.Manitoba..........[Stonehenge.....] DgFsJkJwRtSc Stoned.Michelangelo.A....[...............] AnCsDgEkFbFsGjIwJkJwPpRhRfRrRtSc (Stoned.Michelangelo continued) SgVbWsYr Stoned.No_INT.A..........[Stoned.........] AnDgFsGjIwJkJwMhRrRtScWsYr Stoned.NOP...............[NOP............] DgJkWs Stoned.Standard.A........[New Zealand....] AnDgEkFbFsGjIwJkJwLsPpRfRrRtScSg (Stoned.Standard continued) VbWs Stoned.Swedish_Disaster..[...............] DgGj Stoned.W-Boot............[W-Boot.........] JkRrScWsYr SVC.3103.A...............[SVC 5.0........] DgEkRfScSg Swiss_Boot...............[Swiss Army.....] FsJkMhRh Tai-Pan.483..............[...............] FsIwJkJwMhRtVb Tai-Pan.666..............[D2D............] DgEkJkJwMhPpRtWs Tequila.A................[...............] CsDgFsIwJkJwLsRfRtScSgVbWsYr Three_Tunes.A............[1784...........] GjJkSc Trakia.653...............[...............] RrSc Tremor.A.................[...............] AnFsIwJkRtVbWs Trojector.1463...........[Athens.........] DgFsJkJw Urkel....................[Nwait .........] FsJkVbWs V-Sign...................[Cansu,Sigalit..] DgFsGjIwJkJwLsMhRhRfRrRtScSgVbWs (V-Sign continued) Yr Vacsina.TP-05.A..........[RCE-1206.......] DgFsGjIwJwRfRtScWs Vacsina.TP-16.A..........[RCE-1339.......] DgFsJwRh Vampiro..................[...............] DgWs Vienna.648.Reboot.A......[DOS-62.........] DgEkJw Vinchuca.................[...............] DgWs Virogen.Pinworm..........[...............] GjJk VLamiX...................[Die Lamer......] DgMhRt WelcomB..................[Bupt...........] IwJkJwRt WXYC.....................[...............] GjJkJwRhScWs Yankee Doodle.TP-39......[RCE-2772.......] DgFs Yankee Doodle.TP-44.A....[RCE-2885.......] DgEkFsIwJwLsMhRfRtScVb Yankee Doodle.XPEH.4928..[Micropox.......] FsJkYr ============================================================================ Total for main list: 157 ============================================================================ This additional list includes viruses reported by a single participant and are usually either moving onto the main list, or dropping off of it. CARO Name of Virus [Alias(es) ] Reported by: ============================================================================ 2up.6000.................[...............] Ek Accept.3773..............[...............] Yr Aircop.Standard..........[...............] Oh Anarchy.2048.............[...............] Ek Anticad.2900.............[Plastique.2900.] Jw Bad_Sectors.A............[...............] Yr Benito...................[...............] Ls Boot-446.................[Pasta..........] Dg Bosnia:TPE.1_4...........[...............] Ls Bravo.A..................[...............] An Cantando.................[...............] Mh Cascade.1701.G...........[1701...........] Vb Cascade.1704.D...........[1704...........] Fs Catholic.................[...............] Mh Corgi....................[...............] Dg Danish_Tiny.467..........[...............] Fs Dark_Avenger.2100.SI.A...[V2100..........] Dg Datalock.828.A...........[...............] Yr Diamond.1024.B...........[...............] Fs Dir_II.5.................[...............] Vb Disk_Washer..............[...............] Rh DOS_Hunter...............[...............] Jw Emmie.3097...............[...............] Yr End_of.783...............[...............] Yr Error_Vir................[...............] Mh EXE_Bug.B................[...............] An Filler.A.................[...............] Gj Finnish.357..............[...............] Fs Freddy_Soft..............[...............] Fs Gippo.Epidemic...........[...............] Sc Gippo.JumpingJack........[...............] Yr HLLC.EXE_Engine..........[...............] Vb HLLC.Sauna...............[...............] Fs HLLO.Novademo.*..........[...............] Fs HLLP.Vova.12560..........[...............] Ek Industrial.1841..........[...............] Dg ITV.457..................[...............] Oh Japanese_Xmas.*..........[Xmas in Japan..] Rf Jerusalem.1808.Blank.....[...............] Fs Jerusalem.1808.Critical..[...............] Jw Jerusalem.1808.F.........[...............] Fs Jerusalem.AntiScan.......[...............] Dg Jerusalem.Carfield.......[...............] Dg Jerusalem.Fu_Manchu.A....[80 2086........] Dg Jerusalem.Sunday.II......[Sunday 2.......] Jw Keypress.1744............[...............] Yr Lame_Surprize.B..........[Lamsurp.B......] Dg Mongolian_Boot...........[Mongol.........] Jw MISiS....................[Zharinov,NIKA..] Yr Necropolis.*.............[1963...........] Yr Nice.B...................[...............] Fs November_17.768.A........[...............] Ls Number_of_the_Beast.E....[512,666........] Fb Parity_Boot.A............[...............] Ws PG_Boot..................[...............] Jw PCBB.1784................[...............] Jw Pro......................[KMIT...........] Sc Quit.A...................[555,Dutch......] Dg Renegade.1176............[...............] Ek Rulus....................[...............] Rt She_Has..................[...............] Dg SillyC.377...............[...............] Yr SillyCR.351..............[...............] Yr Stardot.600..............[...............] Ls Stealth_Boot.Alfredo.....[...............] Jw Stealth_Fighter:RDA_20...[...............] Ek Stoned.Michelangelo.K....[...............] Yr Stoned.New_Zealand.......[...............] Gj Storm.1218...............[...............] Yr Street_Fighter:RDA.......[Fighter........] Jw Swiss_Phoenix............[...............] Yr Sword....................[...............] Dg Tikka....................[...............] Dg VCL.Genocide.981.........[...............] An Vmem.....................[...............] Yr Voronezh.1600.A..........[RCE-1600.......] Ek Yeke.1204................[...............] Ls ============================================================================ Total for both lists: 233 ============================================================================ I am currently seeking WildList participants for regional reporting, especially in Central and South America, Spain, former Soviet republics, the Netherlands, China, and Taiwan. Such new participants will need to be in a position where they can monitor and verify virus incidents. People who develop av products are best suited. People who represent one or more av products (agents) and provide localized support may also be qualified if they actually verify the viruses or forward samples to developers. If you thus qualify, please send your name, location, organization, product name, favorite brand of beer, and references (preferably CARO members who know you). Send the information to wildlist@aol.com. Thanks. ============================================================================ The collation of this list is done by Joe Wells, Virus Specialist at IBM's T.J.Watson Research Center, who is solely responsible for its contents. The material presented is implicitly copyrighted under various laws, but may be freely quoted or cited. However, its source and cooperative nature should be duly referenced. No permission is needed to reprint this list. The latest WildList is always posted by me directly to the NCSA Security forum on Compuserve. ============================================================================ WildList Vol 506 - c1jwells@watson.ibm.com - 75511,635 - wildlist@aol.com ============================================================================ -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.7 mQCNAy+wAnYAAAEEAO2alE3YclXZAxkqrSVXkhAuuOsx6NnVfUdKMghYtrBabFuJ +zKiIsahmjeakA2J101KZOHtKMhb5iqLG0oCbRyuBFLtuMhJrjk+L9VRCoxoDB/4 XwFevOGyxRHYfancrIydlMUooe7TZJqbGhhQEROWYm8v6RvkPFtsMpyD+Lb1AAUR tCNKb2UgV2VsbHMgPGMxandlbGxzQHdhdHNvbi5pYm0uY29tPg== =aKXf -----END PGP PUBLIC KEY BLOCK----- ============================================================================