The WildList

February 1995

 ============================================================================
                  PC Viruses in the Wild - February 1, 1995
 ============================================================================
    This is a cooperative listing of viruses reported as being in the wild
    by many virus information professionals. The basis for the reports are
    virus incidents where a sample was received, and positively identified
    by the participant.  Rumors and unverified reports have been excluded.
 
    The list should not be considered a list of "currently common" viruses
    however. No provision is made for commonness. A currency basis for the
    list has been set. Viruses not reported for over a year are removed.
 
    This data indicates only "which" viruses have been found in the wild.
 ============================================================================
    The section below gives the names of participants, along with their
    organization, antivirus product (if any), and geographic location.
  
    Key Participant            Organization      Product        Location  
 ============================================================================
    As  Alan Solomon           S&S Int'l         Toolkit        UK
    Dc  Dave Chess             IBM               IBM AntiVirus  USA       
    Ek  Eugene Kaspersky       KAMI              AVP            Russia
    Fb  Fernando Bonsembiante  Virus Report      None           Argentina 
    Fs  Fridrik Skulason       Frisk Int'l       F-Prot         Iceland
    Gj  Glenn Jordan           Datawatch         VirexPC        USA
    Pd  Paul Ducklin           CSIR Virus Lab    None           So Africa
    Pp  Padgett Peterson       Hobbyist          DiskSecure     USA
    Rf  Richard Ford           Virus Bulletin    None           UK
    Rh  Richard Head           Jade Corp         Scan Vakzin    Japan     
    Rr  Roger Riordan          CYBEC             VET            Australia
    Sc  Shane Coursen          Symantec          NAV            USA       
    Sg  Shimon Gruper          EliaShim          ViruSafe       Israel
    Vb  Vesselin Bontchev      U of Hamburg      None           Germany
    Ws  Wolfgang Stiller       Stiller Research  Integ Master   USA
    Yr  Yuval Rakavi           BRM               Untouchable    Israel    
 ============================================================================
   The first chart is based on two or more participants reporting a virus. 
   Therefore, these viruses are probably more geographically scattered.   
  
  CARO Name of Virus        AsDcEkFbFsGjPdPpRfRhRrScSgVbWsYr  Alias(es)
 ============================================================================
  AntiCMOS.A...............| . x . . x . . . . . . x . . . x | Lenart
  AntiEXE.A................| x x . . x x x . . . . x . x . x | D3,Newbug
  Baclab...................| . . . . . . . x . . . x . . . . | 
  Barrotes.1310.A..........| x . . . . . . . . . . x . . . . | Barrotos
  Boot-437.................| . . . . x . . . . . . x . . . x |
  BootEXE.451..............| . . . . x . . . x . . . . . . . | BFD-451
  Brasil...................| . . . . . . . x . . . x . . . . |
  Butterfly.Butterfly......| . . . . . . . . . . . x . x . x |
  Cascade.1701.A...........| x x . x x x . . x x . . x x . . | 1701
  Cascade.1704.A...........| x x x . x . . . . . . x x x . . | 1704
  Changsha.A...............| . . . . . . . . . x x . . . . . | Centry
  Chinese_Fish.............| x . . . x x . . . . x x . x . x | Fish Boot
  CPW.1527.................| x . . . . . . x . . . x . . . . | Mediera,Mierda
  Dark_Avenger.1800.A......| x x . x x x . . x x x x . . x . | Eddie
  Datalock.920.A...........| x x . . . . . . . . . x x . . x | V920
  Die_Hard.................| . . . . . . . . . . . x . x . . |
  Dir-II.A.................| x x x x x . x . x x x x x x x x | Creeping Death
  Disk_Killer.1_00.........| x . x . . . . x x . . . x . . . | Ogre
  EXE_Bug.A................| x . . . x . x . x . . x x . x . | CMOS Killer
  EXE_Bug.C................| . . . . . . x . . . . . x . x . |
  Fichv.2_1................| x . . . x . . . . . . . x x . . | 905,CHV 2.1
  Filler.A.................| . . . . . x . . . . . x . . . . |
  Flame....................| . . . . . . . . . . x x . x . x | Stoned(3C)
  Flip.2153.A..............| x x . x x . . . x x . x x . . x | Omicron
  Flip.2343................| x . . . x . . . . . . . . . . . | Omicron 2
  Form.A...................| x x . x x x . x x x . x x x x x | Form 18
  Form.D...................| . . . . x . . . . . . x . . . x | Form May
  Freddy_Krueger...........| . . . . x . . . . . . x . . . x | Freddy 2
  Frodo.Frodo.A............| x . . x x . . . . x x x x x . x | 4096,100 Year
  Ginger...................| . . . . . . . . . . x x . . . . | Gingerbread
  Green_Caterpillar.1575.A.| x x . . x x . . x x x x x x x . | Find,1591,1575
  Helloween.1376.A.........| x . . . . . . . x x x x . . x x | 1376
  Hidenowt.................| x . . . . . . . x . . x . . . . |
  Jerusalem.1808.Standard..| x x . x x x x x x x . x x . x x | 1808,Israeli
  Jerusalem.Anticad.4096.B.| x . . . x . . . . . . . x . . . | Invader
  Jerusalem.Mummy.2_1.A....| x . . . x . x . . x . . x . . . | PC Mummy
  Jerusalem.Sunday.A.......| . . . . . . x . . x . . . . . . | Sunday
  Jerusalem.Zero_Time.Aust.| x x . . . . . . . . x . x . x . | Slow
  Joshi.A..................| x x . . x x . x x x x x x x x x |
  Jumper...................| x . . . x . . . . . . x . x . x | French Boot
  Junkie...................| . . . . x . . . . . x . . x . x |
  Kampana.A................| x x . x x x . . x x . x . . x . | AntiTel,Telecom
  Kaos4....................| . . . . x . x . . . . x . . . . |
  Keypress.1232.A..........| x x . . . . . . x x x . x . x x | Turku,Twins
  Lemming..................| . . . . . . . . . . x x . . . . |
  Liberty.2857.A...........| . x . . x . . . x x . x . . x x | Mystic,Magic
  Little_Red...............| . . . . . x x . . . . x . . . . | Red Book
  Maltese Amoeba...........| x x . . x . x x x . . . x . x x | Grain of Sand
  Music_Bug................| . . . . x x . x . . . . . . x . |
  NJH2LBC.A................| x . . . . . . . . . . . . . . x | Korea Boot
  No_Frills.Dudley.........| x . . . . . . . . . x . . . . . | Oi Dudley
  No_Frills.No_Frills.843..| . . . . . . . . . . x x . . . . |
  Nomenklatura.A...........| x x . . . . . . . . . . . . . . | Nomen
  November_17th.855.A......| x x . . x . . . . . . x . . . . | V855
  NPox.963.A...............| . . . . x . . . . . . x . . . . | Evil Genius
  NYB......................| . . . . x . . . . . . x . . . x | B1
  One_Half.................| . . . . . . . . x . . x . x . . |
  Ontario.1024.............| . x . . . . . . . . x . x . . . | SBC,1024
  Parity_Boot.B............| x x . . x . x . x x . x . x . . | Generic 1
  Pathogen:SMEG.0_1........| x . . . . . . . x . . . . . . . |
  Ping_Pong.B..............| x x . x . . . . x . . . x . x x | Italian
  Predator.2448............| . . . . x . . . . . . x . . . . | 2448
  Print_Screen_Boot.A......| x x . . . . . . . . . x . . . x | India,PrnSn
  QRry.....................| . x . . . . . . . . . x . . . . | Query,Quarry
  Quox.....................| . x . . x . . . . . . x . . . . | Stealth 2
  Ripper...................| x x . . x . x . . . . x . x . . | Jack Ripper
  Red_Book.................| . . . . . . x . . . . x . . . . |
  Sampo....................| x . . . x . . . . . . . . . . . | 
  Sat_Bug.Natas............| x . . . x . . . . . . x . x . . | Satan
  Sat_Bug.Sat_Bug..........| . . . . . . . . . . . x . . . x | Satan Bug
  Sayha....................| . . . . . . . . . . . x . . . x |
  Screaming_Fist.II.696....| x x . . . x . . . . . x . . x . | Fist 2,Scream 2
  Sleep_Walker.............| . . . . . . . . . . x x . . . . |
  Stardot.789.A............| . x . . . . . . . . . x . . . . | 805
  Stealth_Boot.B...........| . x . . . . . x x . . x . x . . | STB
  Stealth_Boot.C...........| . . . . . x . . . . . . . x . x | 
  Stoned.16.A..............| x x . . . . . . . . . x . . . x | Brunswick
  Stoned.Azusa.A...........| x x . . x . x x . x x x x . x x | Hong Kong
  Stoned.Bunny.A...........| . . . . . . x . . . . . . . x . |
  Stoned.Dinamo.*..........| . . . . . . . . . . . x . . . x |
  Stoned.Empire.Monkey.A...| . x . . . . . . . . x x . . . . | Monkey
  Stoned.Empire.Monkey.B...| x x . . x x x x x . x x . x x . | Monkey 2
  Stoned.June_4th.A........| x . . . . x . . . x x x . x x x | Bloody!,Beijing
  Stoned.Lzr...............| . x . . x . . . . . . x . . . x | Stoned.Whit
  Stoned.Manitoba..........| . x . . x . . . . . . x . . . . | Stonehenge
  Stoned.Michelangelo.A....| x x x x x x x x x x x x x x x x |
  Stoned.No_INT.A..........| x x . . x x x . x . x x . . x x | Stoned
  Stoned.Standard.A........| x . x x x x x x x x x x x x x . | New Zealand
  Stoned.Swedish_Disaster.A| x . . . . x . . . . . . . . . . |
  Stoned.W-Boot............| . . . . . . . . . . x x . . . x | W-Boot
  SVC.3103.A...............| x . x . . . . . . x . x x . . . | SVC 5.0
  Tai-Pan.483..............| . . . . x . . . . . . . . x . . |
  Tai-Pan.666..............| x . x . . . . x . . . . . . . . |
  Tequila.A................| x x . . x . . . x x . x x x x x |
  Three_Tunes.A............| . . . . . x . . . . . x . . . . | 1784
  Trakia.653...............| . . . . . . . . . . x x . . . . | 
  Tremor.A.................| . . . . x . x . x . . . . x x . |
  Trojector.1463...........| . . . . x . . . . . . x . . . . | Athens
  V-Sign...................| x x . . x x . . x x x x x x x x | Cansu,Sigalit
  Vacsina.TP-05.A..........| x x . . x x . . x x . x . . x . | RCE-1206
  Vacsina.TP-16.A..........| x x . . x . . . . . . . . . . . | RCE-1339
  Vienna.648.Reboot.A......| x x x . . . . . . . . . . . . . | DOS-62
  WXYC.....................| . x . . . . . . . . . x . . . . |
  Yankee Doodle.TP-39......| x . . . x . . . . . . . . . . . | RCE-2772
  Yankee Doodle.TP-44.A....| x . x . x . . . x x . x . x . . | RCE-2885
  Yankee Doodle.XPEH.4928..| . . . . x . . . . . . . . . . x | Micropox
 ============================================================================
  Total for first list: 106
 ============================================================================
   The second chart is based on a single participant noting more than one 
   infection site and may signify limited regional virus outbreaks.
  
  CARO Name of Virus         AsDcEkFbFsGjPdPpRfRhRrScVbWsYr Alias(es)
 ============================================================================
  2up.6000.................| . . x . . . . . . . . . . . . . | 
  5lo......................| . . . . x . . . . . . . . . . . | 
  Accept.377...............| . . . . . . . . . . . . . . . x |
  Avispa.D.................| . . . . . . . . . . . x . . . . |
  BackFormat.A.............| . . . . . . . . . . . . . . . x |
  Bad_Sectors.A............| . . . . . . . . . . . . . . . x |
  Bravo.A..................| . . . . . . x . . . . . . . . . |
  Cascade.1701.G...........| . . . . . . . . . . . . . x . . | 1701
  Cascade.1704.D...........| . . . . x . . . . . . . . . . . | 1704
  Chaos.1241...............| . . . . . . . . . . . . . . . x |
  Chill....................| . . . . . . . . . . . x . . . . | Chill Touch
  Civil_Defence............| . . . . . . x . . . . . . . . . |
  Coffeeshop:MtE...........| . . . . . . x . . . . . . . . . |
  Corgi....................| x . . . . . . . . . . . . . . . |
  Danish_Tiny.467..........| . . . . x . . . . . . . . . . . | 
  Dark_Avenger.2100.SI.A...| x . . . . . . . . . . . . . . . | V2100
  Datalock.828.A...........| . . . . . . . . . . . . . . . x |
  Den_Zuko.2.A.............| x . . . . . . . . . . . . . . . | Den Zuk
  Diamond.1024.B...........| . . . . x . . . . . . . . . . . | 
  Dir_II.5.................| . . . . . . . . . . . . . x . . |
  DOS_Hunter...............| . x . . . . . . . . . . . . . . |
  Emmie.3097...............| . . . . . . . . . . . . . . . x |
  End_of.783...............| . . . . . . . . . . . . . . . x |
  Even_Beeper.B............| . x . . . . . . . . . . . . . . |
  EXE_Bug.B................| . . . . . . x . . . . . . . . . |
  EXE_Bug.Hooker...........| . . . . . . x . . . . . . . . . |
  Finnish.357..............| . . . . x . . . . . . . . . . . | 
  Finnish_Sprayer..........| . . . . x . . . . . . . . . . . | 
  Freddy_Soft..............| . . . . x . . . . . . . . . . . | 
  Galicia..................| . . . . . . . . . . . x . . . . | Telecom
  Gippo.Epidemic...........| . . . . . . . . . . . x . . . . |
  Gippo.JumpingJack........| . . . . . . . . . . . . . . . x |
  Hafenstrasse.*...........| . . . . . . . . . . . . . x . . | Hafen
  Hi.460...................| . . . . . . . . . . . . . . . x | Hi
  HLLC.Even_Beeper.B.......| x . . . . . . . . . . . . . . . |
  HLLC.EXE_Engine..........| . . . . . . . . . . . . . x . . |
  HLLO.Novademo.*..........| . . . . x . . . . . . . . . . . | 
  HLLC.Sauna...............| . . . . x . . . . . . . . . . . | 
  HLLP.Vova.12560..........| . . x . . . . . . . . . . . . . | 
  Ibex.....................| . . . . . . . . . . . x . . . . | Seven_Boot
  Industrial.1841..........| x . . . . . . . . . . . . . . . |
  Involuntary.*............| . . . . . . . . . . . x . . . . | Invol
  Japanese_Xmas.*..........| . . . . . . . . . x . . . . . . | Xmas in Japan
  Jerusalem.1244...........| x . . . . . . . . . . . . . . . | 1244
  Jerusalem.1808.Blank.....| . . . . x . . . . . . . . . . . |
  Jerusalem.1808.Critical..| . x . . . . . . . . . . . . . . |
  Jerusalem.1808.F.........| . . . . x . . . . . . . . . . . |
  Jerusalem.Anticad.4096.A.| . . . . . . . . . . . . . x . . | Plastique
  Jerusalem.Carfield.......| x . . . . . . . . . . . . . . . |
  Jerusalem.Fu_Manchu.A....| x . . . . . . . . . . . . . . . | 2080,2086
  Jerusalem.Sunday.II......| . x . . . . . . . . . . . . . . | Sunday 2
  Jihuu.686................| . . . . x . . . . . . . . . . . |
  Joshi.B..................| . . . . . . . . . . . x . . . . |
  Keypress.1744............| . . . . . . . . . . . . . . . x |
  Lame_Surprize.B..........| x . . . . . . . . . . . . . . . | Lamsurp.B
  Little_Brother.307.......| . . . . x . . . . . . . . . . . |
  MacGyver.2803............| . . . . . . x . . . . . . . . . |
  MIREA.1788...............| . . x . . . . . . . . . . . . . | Lyceum,Lycee
  MISiS....................| . . . . . . . . . . . . . . . x | Zharinov,NIKA
  Necropolis.*.............| . . . . . . . . . . . . . . . x | 1963
  Necros...................| x . . . . . . . . . . . . . . . | Gnose,Irish3
  Nice.B...................| . . . . x . . . . . . . . . . . |
  November_17th.800.A......| . . . . . . . . . . . x . . . . | Jan1, 800
  Number_of_the_Beast.E....| . . . x . . . . . . . . . . . . | 512,666
  Parity_Boot.A............| . . . . . . . . . . . . . . x . |
  PG_Boot..................| . x . . . . . . . . . . . . . . | 
  Peter....................| . x . . . . . . . . . . . . . . | Peter II
  Pro......................| . . . . . . . . . . . x . . . . | KMIT
  Queeg:SMEG.0_1...........| x . . . . . . . . . . . . . . . | 
  Quit.A...................| x . . . . . . . . . . . . . . . | 555,Dutch
  Renegade.1176............| . . x . . . . . . . . . . . . . | 
  Riihi....................| . . . . x . . . . . . . . . . . |
  SillyC.377...............| . . . . . . . . . . . . . . . x |
  SillyCR.351..............| . . . . . . . . . . . . . . . x |
  Stoned.Bravo.............| . . . . . . x . . . . . . . . . |
  Stoned.Empire.Int_10.B...| . . . . . . . x . . . . . . . . |
  Stoned.Kiev..............| . . x . . . . . . . . . . . . . | 
  Stoned.Michelangelo.K....| . . . . . . . . . . . . . . . x |
  Stoned.New_Zealand.......| . . . . . x . . . . . . . . . . | 
  Stoned.NOP...............| . . . . . . . . . . . . . . x . | NOP
  Storm.1218...............| . . . . . . . . . . . . . . . x |
  SVC.2936.................| . . . . . . . . . . . x . . . . | 
  SVC.3241.................| . x . . . . . . . . . . . . . . | 
  Swiss_Boot...............| . . . . x . . . . . . . . . . . | Swiss Army
  Swiss_Phoenix............| . . . . . . . . . . . . . . . x |
  Sibylle..................| x . . . . . . . . . . . . . . . |
  Sword....................| x . . . . . . . . . . . . . . . |
  Tikka....................| x . . . . . . . . . . . . . . . |
  Virogen.Pinworm..........| . . . . . x . . . . . . . . . . | 
  Vmem.....................| . . . . . . . . . . . . . . . x |
  Voronezh.1600.A..........| . . x . . . . . . . . . . . . . | RCE-1600
 ============================================================================
  Total for both lists: 197
 ============================================================================
  The collation of this list is done by Joe Wells, Virus Specialist at IBM's
  T.J.Watson Research Center, who is solely responsible for its contents.
 
  The material presented is implicitly copyrighted under various laws, but
  may be freely quoted or cited. However, its source and cooperative nature
  should be duly referenced. Feel free to distribute this list.
 
  Other antivirus product developers are invited to participate in the list. 
  If you wish to do so, please contact me.
 ============================================================================
 The WILDList by Joe Wells -- [email protected] -- 75511,635 -- Vol3.02
 ============================================================================