The WildList
June 1995
============================================================================
PC Viruses in the Wild - June 10, 1995
============================================================================
This is a cooperative listing of viruses reported as being in the wild
by many virus information professionals. The basis for the reports are
virus incidents where a sample was received, and positively identified
by the participant. Rumors and unverified reports have been excluded.
The list should not be considered a list of "currently common" viruses
however. No provision is made for commonness. A currency basis for the
list has been set. Viruses not reported for over a year are removed.
This data indicates only "which" viruses have been found in the wild.
============================================================================
The section below gives the names of participants, along with their
geographic location, organization, and antivirus product (if any). The
locations with an asterisk (*) note that the reports are regional, all
others being international or global.
Key Participant *Location Organization Product
============================================================================
An Anthony Naggs *So Africa CSIR Virus Lab VPS
Cs Christian Schmid *Austria DataPROT Linz F-Prot
Dg Dmitry Gryaznov UK S&S Int'l Toolkit
Ek Eugene Kaspersky *Russia KAMI AVP
Fb Fernando Bonsembiante *Argentina Virus Report None
Fs Fridrik Skulason Iceland Frisk Int'l F-Prot
Gj Glenn Jordan USA Datawatch VirexPC
Iw Ian Whalley UK Virus Bulletin None
Jk Jimmy Kuo USA McAfee ViruScan
Jw Joe Wells USA IBM IBM AntiVirus
Ls Luca Sambucci *Italy/Swiz. Gruppo Editoriale None
Mh Mikko Hypponen *Finland Data Felows F-Prot
Ms Marek Sell *Poland APEXIM MkS_vir
Oh Omar Herrera *Mexico Escuadron AV Aguila AV
Pp Padgett Peterson USA Hobbyist DiskSecure
Rh Richard Head *Japan Jade Corp Scan Vakzin
Rr Roger Riordan Australia CYBEC VET
Rt Roger Thompson USA Thompson Network Doctor
Rv Robert Vibert *Portugal RSVP None
Sc Shane Coursen USA Symantec NAV
Sg Shimon Gruper *Israel EliaShim ViruSafe
Vb Vesselin Bontchev *Germany U of Hamburg None
Ws Wolfgang Stiller USA Stiller Research Integ Master
Yr Yuval Rakavi Israel BRM Untouchable
============================================================================
The people below will be future participants in the WildList.
============================================================================
Ad Allan Dyer *Hong Kong Yui Kee Co. Ltd.
Cm Clyde Meli *Malta University of Malta
Fl Ferenc Leitold *Hungary Hunix Ltd.
Gp Gabriel Pislaru *Romania SoftWin
Lc Lucian Caric *Croatia Bug Computer Magazine
Ml Mikael Larsson *Sweden QA Informatik
Nb Neville Bulsara *India Quantum System Software
Pb Pavel Baudis *Czech Rep Alwil Software
Pl Pascal Loitner *France
Rf Richard Ford USA NCSA
============================================================================
This main list includes viruses reported by multiple participants.
CARO Name of Virus [ Alias(es) ] Reported by:
============================================================================
5Lo......................[...............] FsMh
Anticad.4096.A...........[Plastique......] JkVb
Anticad.4096.B...........[Invader........] DgFsJkSg
AntiCMOS.A...............[Lenart.........] DgFsGjIwJkJwMhRhRfRtScVbWsYr
AntiEXE.A................[D3,Newbug......] AnDgFsGjIwJkJwMhRfRtScVbWsYr
Arianna.3375.............[...............] IwLs
Avispa.D.................[...............] JkJwRtSc
BackFormat.A.............[Backform.......] JkMhYr
Baclab...................[...............] JkPpRtSc
Barrotes.1310.A..........[Barrotos.......] DgJkRvSc
Boot-437.................[...............] FsGjJkJwRhRtScWsYr
BootEXE.451..............[BFD-451........] FsIwJkMh
Brasil...................[...............] PpSc
Butterfly.Butterfly......[...............] VbYr
Cascade.1701.A...........[1701...........] DgFbFsGjIwJkJwLsMhRfRtSgVbWs
Cascade.1704.A...........[1704...........] DgEkFsJwRtScSgVb
Changsha.A...............[Centry.........] RfRrRt
Chaos.1241...............[...............] JkRrYr
Chill....................[Chill Touch....] JkRtSc
Chinese_Fish.............[Fish Boot......] DgFsGjJkRrRtVbYr
Civil_Defence.6672.......[CDV 3.3........] AnJw
Coffeeshop:MtE...........[...............] AnJk
CPW.1527.................[Mediera,Mierda.] DgJkPpSc
Crazy_Boot...............[...............] DgJkJwRhSc
DA_Boys..................[...............] JkRtWs
Dark_Avenger.1800.A......[Eddie..........] DgFbFsGjIwJwLsRfRrWs
Datalock.920.A...........[V920...........] DgJwLsSgYr
DelWin.1759..............[...............] JwVb
Den_Zuko.2.A.............[Den Zuk........] DgRt
Die_Hard.................[Wix............] AnIwJkJwRtScVbWs
Dir-II.A.................[Creeping Death.] AnDgEkFbFsIwJkJwOhRfRrScSgVbWsYr
Disk_Killer.1_00.........[Ogre...........] DgEkIwPpSg
Espejo...................[Stakka,IFE.....] JkJwRtSc
EXE_Bug.A................[CMOS Killer....] AnDgFsIwJkRtScSgWs
EXE_Bug.C................[...............] AnRtSgWs
EXE_Bug.Hooker...........[...............] AnRt
Fairz....................[Khobar.........] JkMh
Fat_Avenger..............[...............] JwRr
Fichv.2_1................[905,CHV 2.1....] DgFsSgVb
Finnish_Sprayer..........[...............] FsMhSc
Flame....................[Stamford.......] JkJwRrScVbYr
Flip.2153.A..............[Omicron........] DgFbFsIwJkJwLsRhRfScSgWsYr
Flip.2343................[Omicron 2......] DgFsLsRv
Form.A...................[Form 18........] CsDgFbFsGjIwJkJwLsMhPpRfRtRvScSg
(Form.A continued) VbWsYr
Form.D...................[Form May.......] FsJwRtScYr
Frankenstein.............[Frank..........] DgJk
Freddy_Krueger...........[Freddy 2.......] FsJkScWsYr
Frodo.Frodo.A............[4096,100 Year..] DgFbFsJkJwRfRrSgVbYr
Galicia..................[Telecom........] JkRtSc
Ginger...................[Gingerbread....] JkRrSc
GoldBug..................[...............] DgJkIwMh
Green_Caterpillar.1575...[Find,1591,1575.] DgFsGjIwJkJwLsRfRrRtScSgVbWs
Hafenstrasse.*...........[Hafen..........] JkVb
Helloween.1376.A.........[1376...........] DgIwJkJwRfRrScWsYr
Hi.460...................[Hi.............] JkYr
Hidenowt.................[...............] DgIwJkRhSc
HLLC.Even_Beeper.B.......[...............] DgJwWs
Ibex.....................[Seven_Boot.....] JwSc
J&M......................[Jimi.Jimmy.....] JkJwRfVb
Jerusalem.1244...........[1244...........] DgLs
Jerusalem.1808.Standard..[1808,Israeli...] AnDgFbFsGjIwJkJwLsPpRfRtScSgWsYr
Jerusalem.Mummy.2_1.A....[PC Mummy.......] AnDgFsRfRtSg
Jerusalem.Sunday.A.......[Sunday.........] AnJkRfRt
Jerusalem.Zero_Time.Aust.[Slow...........] DgJkJwRhRrRtSgWs
Jihuu.686................[...............] FsMh
Joshi.A..................[...............] DgFsGjIwJkJwPpRfRrRtScSgVbWsYr
Jumper.A.................[French Boot....] DgFsGjJwRtScVbWsYr
Jumper.B.................[SillyBop.......] DgMhRhVb
Junkie...................[...............] CsFsIwJkJwLsMhRhRrRtVbWsYr
Kampana.A................[AntiTel,Telecom] DgFbFsGjIwJkJwMhRhRfRtRvScWs
Kaos4....................[...............] AnFsJkMhSc
Keypress.1232.A..........[Turku,Twins....] DgIwJwRfRrRtSgWsYr
Leandro..................[...............] JkJwRtSc
Lemming..................[...............] RrSc
Liberty.2857.A...........[Mystic,Magic...] FsIwJwRhRfRtWsYr
Little_Brother.307.......[...............] FsJk
Little_Red...............[Red Book.......] AnGjJkJwRhRtSc
MacGyver.2803............[Shoo...........] AnJk
Maltese Amoeba...........[Grain of Sand..] AnDgFsIwJkJwPpRtSgWsYr
Mange_Tout.1099..........[...............] DgJkMhRf
Markt.1533...............[Werbe..........] DgJk
MIREA.1788...............[Lyceum,Lycee...] EkJk
Music_Bug................[...............] FsGjJkPpWs
Necros...................[Gnose,Irish3...] DgJk
Neuroquila...............[Havoc..........] DgIwJkWs
NJH2LBC.A................[Korea Boot.....] DgJkYr
No_Frills.Dudley.........[Oi Dudley......] DgJkRrRt
No_Frills.No_Frills.843..[...............] JkRrSc
Nomenklatura.A...........[Nomen..........] DgJkJw
November_17th.800.A......[Jan1,800.......] LsSc
November_17th.855.A......[V855...........] DgFsJkJwLsRtSc
NPox.963.A...............[Evil Genius....] FsSc
NYB......................[B1.............] AnDgEkFsGjJkJwLsMhRfRtScVbWsYr
One_Half.................[Dis,Free Love..] CsDgEkIwJkJwLsRtScVbWs
Ontario.1024.............[SBC,1024.......] JkJwRrSg
Parity_Boot.B............[Generic 1......] AnCsDgFsGjIwJkJwMhRhRfRtRvScVb
Pathogen:SMEG.0_1........[...............] DgIwJkWs
Peter....................[Peter II.......] JwRhJkRf
Ping_Pong.B..............[Italian........] DgFbIwJkJwLsSgWsYr
Predator.2448............[2448...........] FsSc
Print_Screen_Boot.A......[India,PrnSn....] DgJwScYr
QRry.....................[Query,Essex....] JkJwSc
Queeg:SMEG.0_1...........[...............] DgJk
Quox.....................[Stealth 2......] FsJkJwRhRtSc
Riihi....................[...............] FsMh
Ripper...................[Jack Ripper....] AnCsDgFsGjJkJwMhRhRfRtScVbWs
Russian_Flag.............[...............] AnDg
Sampo....................[Turbo..........] DgFsGjIwJkJwMhRhRfRtScVbWs
Sat_Bug.Natas............[Satan..........] DgFsJwMhJkRtRvScVbWs
Sat_Bug.Sat_Bug..........[Satan Bug......] JkJwYr
Sayha....................[...............] ScYr
Screaming_Fist.II.696....[Fist 2,Scream 2] DgGjJkJwRtScWs
Sibylle..................[...............] DgJw
Sleep_Walker.............[...............] JkRrSc
Stardot.789.A............[805............] JwLsSc
Stealth_Boot.B...........[AMSE NopB......] GjIwJkJwPpRhRtScVb
Stealth_Boot.C...........[AMSE NopB2.....] GjJkJwRtVbYr
Stoned.16.A..............[Brunswick......] DgJwScYr
Stoned.Angelina..........[...............] CsDgIwJkJwMhRvSc
Stoned.Azusa.A...........[Hong Kong......] AnDgFsGjJkJwPpRfRrRtScSgWsYr
Stoned.Bravo.............[...............] AnJk
Stoned.Bunny.A...........[...............] AnWs
Stoned.Dinamo.*..........[...............] RtScYr
Stoned.Empire.Int_10.B...[...............] JkPpRt
Stoned.Empire.Monkey.A...[Monkey.........] IwJkJwRrRtSc
Stoned.Empire.Monkey.B...[Monkey 2.......] AnDgFsGjIwJkJwMhPpRhRfRrRtScVbWs
Stoned.June_4th.A........[Bloody!,Beijing] DgGjJkRfRrScVbWsYr
Stoned.Kiev..............[...............] EkJkRt
Stoned.Lzr...............[Stoned.Whit....] FsGjIwJkJwMhRtScYr
Stoned.Manitoba..........[Stonehenge.....] DgFsJkJwRtSc
Stoned.Michelangelo.A....[...............] AnCsDgEkFbFsGjIwJkJwPpRhRfRrRtSc
(Stoned.Michelangelo continued) SgVbWsYr
Stoned.No_INT.A..........[Stoned.........] AnDgFsGjIwJkJwMhRrRtScWsYr
Stoned.NOP...............[NOP............] DgJkWs
Stoned.Standard.A........[New Zealand....] AnDgEkFbFsGjIwJkJwLsPpRfRrRtScSg
(Stoned.Standard continued) VbWs
Stoned.Swedish_Disaster..[...............] DgGj
Stoned.W-Boot............[W-Boot.........] JkRrScWsYr
SVC.3103.A...............[SVC 5.0........] DgEkRfScSg
Swiss_Boot...............[Swiss Army.....] FsJkMhRh
Tai-Pan.483..............[...............] FsIwJkJwMhRtVb
Tai-Pan.666..............[D2D............] DgEkJkJwMhPpRtWs
Tequila.A................[...............] CsDgFsIwJkJwLsRfRtScSgVbWsYr
Three_Tunes.A............[1784...........] GjJkSc
Trakia.653...............[...............] RrSc
Tremor.A.................[...............] AnFsIwJkRtVbWs
Trojector.1463...........[Athens.........] DgFsJkJw
Urkel....................[Nwait .........] FsJkVbWs
V-Sign...................[Cansu,Sigalit..] DgFsGjIwJkJwLsMhRhRfRrRtScSgVbWs
(V-Sign continued) Yr
Vacsina.TP-05.A..........[RCE-1206.......] DgFsGjIwJwRfRtScWs
Vacsina.TP-16.A..........[RCE-1339.......] DgFsJwRh
Vampiro..................[...............] DgWs
Vienna.648.Reboot.A......[DOS-62.........] DgEkJw
Vinchuca.................[...............] DgWs
Virogen.Pinworm..........[...............] GjJk
VLamiX...................[Die Lamer......] DgMhRt
WelcomB..................[Bupt...........] IwJkJwRt
WXYC.....................[...............] GjJkJwRhScWs
Yankee Doodle.TP-39......[RCE-2772.......] DgFs
Yankee Doodle.TP-44.A....[RCE-2885.......] DgEkFsIwJwLsMhRfRtScVb
Yankee Doodle.XPEH.4928..[Micropox.......] FsJkYr
============================================================================
Total for main list: 157
============================================================================
This additional list includes viruses reported by a single participant and
are usually either moving onto the main list, or dropping off of it.
CARO Name of Virus [Alias(es) ] Reported by:
============================================================================
2up.6000.................[...............] Ek
Accept.3773..............[...............] Yr
Aircop.Standard..........[...............] Oh
Anarchy.2048.............[...............] Ek
Anticad.2900.............[Plastique.2900.] Jw
Bad_Sectors.A............[...............] Yr
Benito...................[...............] Ls
Boot-446.................[Pasta..........] Dg
Bosnia:TPE.1_4...........[...............] Ls
Bravo.A..................[...............] An
Cantando.................[...............] Mh
Cascade.1701.G...........[1701...........] Vb
Cascade.1704.D...........[1704...........] Fs
Catholic.................[...............] Mh
Corgi....................[...............] Dg
Danish_Tiny.467..........[...............] Fs
Dark_Avenger.2100.SI.A...[V2100..........] Dg
Datalock.828.A...........[...............] Yr
Diamond.1024.B...........[...............] Fs
Dir_II.5.................[...............] Vb
Disk_Washer..............[...............] Rh
DOS_Hunter...............[...............] Jw
Emmie.3097...............[...............] Yr
End_of.783...............[...............] Yr
Error_Vir................[...............] Mh
EXE_Bug.B................[...............] An
Filler.A.................[...............] Gj
Finnish.357..............[...............] Fs
Freddy_Soft..............[...............] Fs
Gippo.Epidemic...........[...............] Sc
Gippo.JumpingJack........[...............] Yr
HLLC.EXE_Engine..........[...............] Vb
HLLC.Sauna...............[...............] Fs
HLLO.Novademo.*..........[...............] Fs
HLLP.Vova.12560..........[...............] Ek
Industrial.1841..........[...............] Dg
ITV.457..................[...............] Oh
Japanese_Xmas.*..........[Xmas in Japan..] Rf
Jerusalem.1808.Blank.....[...............] Fs
Jerusalem.1808.Critical..[...............] Jw
Jerusalem.1808.F.........[...............] Fs
Jerusalem.AntiScan.......[...............] Dg
Jerusalem.Carfield.......[...............] Dg
Jerusalem.Fu_Manchu.A....[80 2086........] Dg
Jerusalem.Sunday.II......[Sunday 2.......] Jw
Keypress.1744............[...............] Yr
Lame_Surprize.B..........[Lamsurp.B......] Dg
Mongolian_Boot...........[Mongol.........] Jw
MISiS....................[Zharinov,NIKA..] Yr
Necropolis.*.............[1963...........] Yr
Nice.B...................[...............] Fs
November_17.768.A........[...............] Ls
Number_of_the_Beast.E....[512,666........] Fb
Parity_Boot.A............[...............] Ws
PG_Boot..................[...............] Jw
PCBB.1784................[...............] Jw
Pro......................[KMIT...........] Sc
Quit.A...................[555,Dutch......] Dg
Renegade.1176............[...............] Ek
Rulus....................[...............] Rt
She_Has..................[...............] Dg
SillyC.377...............[...............] Yr
SillyCR.351..............[...............] Yr
Stardot.600..............[...............] Ls
Stealth_Boot.Alfredo.....[...............] Jw
Stealth_Fighter:RDA_20...[...............] Ek
Stoned.Michelangelo.K....[...............] Yr
Stoned.New_Zealand.......[...............] Gj
Storm.1218...............[...............] Yr
Street_Fighter:RDA.......[Fighter........] Jw
Swiss_Phoenix............[...............] Yr
Sword....................[...............] Dg
Tikka....................[...............] Dg
VCL.Genocide.981.........[...............] An
Vmem.....................[...............] Yr
Voronezh.1600.A..........[RCE-1600.......] Ek
Yeke.1204................[...............] Ls
============================================================================
Total for both lists: 233
============================================================================
I am currently seeking WildList participants for regional reporting,
especially in Central and South America, Spain, former Soviet republics,
the Netherlands, China, and Taiwan. Such new participants will need to
be in a position where they can monitor and verify virus incidents. People
who develop av products are best suited. People who represent one or more
av products (agents) and provide localized support may also be qualified
if they actually verify the viruses or forward samples to developers. If
you thus qualify, please send your name, location, organization, product
name, favorite brand of beer, and references (preferably CARO members who
know you). Send the information to [email protected]. Thanks.
============================================================================
The collation of this list is done by Joe Wells, Virus Specialist at IBM's
T.J.Watson Research Center, who is solely responsible for its contents.
The material presented is implicitly copyrighted under various laws, but
may be freely quoted or cited. However, its source and cooperative nature
should be duly referenced. No permission is needed to reprint this list.
The latest WildList is always posted by me directly to the NCSA Security
forum on Compuserve.
============================================================================
WildList Vol 506 - [email protected] - 75511,635 - [email protected]
============================================================================
-----BEGIN PGP PUBLIC KEY BLOCK-----
Version: 2.7
mQCNAy+wAnYAAAEEAO2alE3YclXZAxkqrSVXkhAuuOsx6NnVfUdKMghYtrBabFuJ
+zKiIsahmjeakA2J101KZOHtKMhb5iqLG0oCbRyuBFLtuMhJrjk+L9VRCoxoDB/4
XwFevOGyxRHYfancrIydlMUooe7TZJqbGhhQEROWYm8v6RvkPFtsMpyD+Lb1AAUR
tCNKb2UgV2VsbHMgPGMxandlbGxzQHdhdHNvbi5pYm0uY29tPg==
=aKXf
-----END PGP PUBLIC KEY BLOCK-----
============================================================================
