The WildList

June 1995

 ============================================================================
                  PC Viruses in the Wild - June 10, 1995
 ============================================================================
    This is a cooperative listing of viruses reported as being in the wild
    by many virus information professionals. The basis for the reports are
    virus incidents where a sample was received, and positively identified
    by the participant.  Rumors and unverified reports have been excluded.
 
    The list should not be considered a list of "currently common" viruses
    however. No provision is made for commonness. A currency basis for the
    list has been set. Viruses not reported for over a year are removed.
 
    This data indicates only "which" viruses have been found in the wild.
 ============================================================================
    The section below gives the names of participants, along with their
    geographic location, organization, and antivirus product (if any). The
    locations with an asterisk (*) note that the reports are regional, all
    others being international or global.
 
    Key Participant           *Location     Organization      Product
 ============================================================================
    An  Anthony Naggs         *So Africa    CSIR Virus Lab    VPS
    Cs  Christian Schmid      *Austria      DataPROT Linz     F-Prot
    Dg  Dmitry Gryaznov        UK           S&S Int'l         Toolkit
    Ek  Eugene Kaspersky      *Russia       KAMI              AVP
    Fb  Fernando Bonsembiante *Argentina    Virus Report      None
    Fs  Fridrik Skulason       Iceland      Frisk Int'l       F-Prot
    Gj  Glenn Jordan           USA          Datawatch         VirexPC
    Iw  Ian Whalley            UK           Virus Bulletin    None
    Jk  Jimmy Kuo              USA          McAfee            ViruScan
    Jw  Joe Wells              USA          IBM               IBM AntiVirus
    Ls  Luca Sambucci         *Italy/Swiz.  Gruppo Editoriale None
    Mh  Mikko Hypponen        *Finland      Data Felows       F-Prot
    Ms  Marek Sell            *Poland       APEXIM            MkS_vir 
    Oh  Omar Herrera          *Mexico       Escuadron AV      Aguila AV
    Pp  Padgett Peterson       USA          Hobbyist          DiskSecure
    Rh  Richard Head          *Japan        Jade Corp         Scan Vakzin
    Rr  Roger Riordan          Australia    CYBEC             VET
    Rt  Roger Thompson         USA          Thompson Network  Doctor
    Rv  Robert Vibert         *Portugal     RSVP              None
    Sc  Shane Coursen          USA          Symantec          NAV
    Sg  Shimon Gruper         *Israel       EliaShim          ViruSafe
    Vb  Vesselin Bontchev     *Germany      U of Hamburg      None
    Ws  Wolfgang Stiller       USA          Stiller Research  Integ Master
    Yr  Yuval Rakavi           Israel       BRM               Untouchable
 ============================================================================
  The people below will be future participants in the WildList.
 ============================================================================
    Ad  Allan Dyer            *Hong Kong    Yui Kee Co. Ltd.
    Cm  Clyde Meli            *Malta        University of Malta
    Fl  Ferenc Leitold        *Hungary      Hunix Ltd.
    Gp  Gabriel Pislaru       *Romania      SoftWin   
    Lc  Lucian Caric          *Croatia      Bug Computer Magazine
    Ml  Mikael Larsson        *Sweden       QA Informatik
    Nb  Neville Bulsara       *India        Quantum System Software
    Pb  Pavel Baudis          *Czech Rep    Alwil Software
    Pl  Pascal Loitner        *France
    Rf  Richard Ford           USA          NCSA
 ============================================================================
  This main list includes viruses reported by multiple participants.
 
  CARO Name of Virus       [ Alias(es)     ] Reported by:
 ============================================================================
  5Lo......................[...............] FsMh
  Anticad.4096.A...........[Plastique......] JkVb
  Anticad.4096.B...........[Invader........] DgFsJkSg
  AntiCMOS.A...............[Lenart.........] DgFsGjIwJkJwMhRhRfRtScVbWsYr
  AntiEXE.A................[D3,Newbug......] AnDgFsGjIwJkJwMhRfRtScVbWsYr
  Arianna.3375.............[...............] IwLs
  Avispa.D.................[...............] JkJwRtSc
  BackFormat.A.............[Backform.......] JkMhYr
  Baclab...................[...............] JkPpRtSc
  Barrotes.1310.A..........[Barrotos.......] DgJkRvSc
  Boot-437.................[...............] FsGjJkJwRhRtScWsYr
  BootEXE.451..............[BFD-451........] FsIwJkMh
  Brasil...................[...............] PpSc
  Butterfly.Butterfly......[...............] VbYr
  Cascade.1701.A...........[1701...........] DgFbFsGjIwJkJwLsMhRfRtSgVbWs
  Cascade.1704.A...........[1704...........] DgEkFsJwRtScSgVb
  Changsha.A...............[Centry.........] RfRrRt
  Chaos.1241...............[...............] JkRrYr
  Chill....................[Chill Touch....] JkRtSc
  Chinese_Fish.............[Fish Boot......] DgFsGjJkRrRtVbYr
  Civil_Defence.6672.......[CDV 3.3........] AnJw
  Coffeeshop:MtE...........[...............] AnJk
  CPW.1527.................[Mediera,Mierda.] DgJkPpSc
  Crazy_Boot...............[...............] DgJkJwRhSc
  DA_Boys..................[...............] JkRtWs
  Dark_Avenger.1800.A......[Eddie..........] DgFbFsGjIwJwLsRfRrWs
  Datalock.920.A...........[V920...........] DgJwLsSgYr
  DelWin.1759..............[...............] JwVb
  Den_Zuko.2.A.............[Den Zuk........] DgRt
  Die_Hard.................[Wix............] AnIwJkJwRtScVbWs
  Dir-II.A.................[Creeping Death.] AnDgEkFbFsIwJkJwOhRfRrScSgVbWsYr
  Disk_Killer.1_00.........[Ogre...........] DgEkIwPpSg
  Espejo...................[Stakka,IFE.....] JkJwRtSc
  EXE_Bug.A................[CMOS Killer....] AnDgFsIwJkRtScSgWs
  EXE_Bug.C................[...............] AnRtSgWs
  EXE_Bug.Hooker...........[...............] AnRt
  Fairz....................[Khobar.........] JkMh
  Fat_Avenger..............[...............] JwRr
  Fichv.2_1................[905,CHV 2.1....] DgFsSgVb
  Finnish_Sprayer..........[...............] FsMhSc
  Flame....................[Stamford.......] JkJwRrScVbYr
  Flip.2153.A..............[Omicron........] DgFbFsIwJkJwLsRhRfScSgWsYr
  Flip.2343................[Omicron 2......] DgFsLsRv
  Form.A...................[Form 18........] CsDgFbFsGjIwJkJwLsMhPpRfRtRvScSg
    (Form.A continued)                         VbWsYr
  Form.D...................[Form May.......] FsJwRtScYr
  Frankenstein.............[Frank..........] DgJk
  Freddy_Krueger...........[Freddy 2.......] FsJkScWsYr
  Frodo.Frodo.A............[4096,100 Year..] DgFbFsJkJwRfRrSgVbYr
  Galicia..................[Telecom........] JkRtSc
  Ginger...................[Gingerbread....] JkRrSc
  GoldBug..................[...............] DgJkIwMh
  Green_Caterpillar.1575...[Find,1591,1575.] DgFsGjIwJkJwLsRfRrRtScSgVbWs
  Hafenstrasse.*...........[Hafen..........] JkVb
  Helloween.1376.A.........[1376...........] DgIwJkJwRfRrScWsYr
  Hi.460...................[Hi.............] JkYr
  Hidenowt.................[...............] DgIwJkRhSc
  HLLC.Even_Beeper.B.......[...............] DgJwWs
  Ibex.....................[Seven_Boot.....] JwSc
  J&M......................[Jimi.Jimmy.....] JkJwRfVb
  Jerusalem.1244...........[1244...........] DgLs
  Jerusalem.1808.Standard..[1808,Israeli...] AnDgFbFsGjIwJkJwLsPpRfRtScSgWsYr
  Jerusalem.Mummy.2_1.A....[PC Mummy.......] AnDgFsRfRtSg
  Jerusalem.Sunday.A.......[Sunday.........] AnJkRfRt
  Jerusalem.Zero_Time.Aust.[Slow...........] DgJkJwRhRrRtSgWs
  Jihuu.686................[...............] FsMh
  Joshi.A..................[...............] DgFsGjIwJkJwPpRfRrRtScSgVbWsYr
  Jumper.A.................[French Boot....] DgFsGjJwRtScVbWsYr
  Jumper.B.................[SillyBop.......] DgMhRhVb
  Junkie...................[...............] CsFsIwJkJwLsMhRhRrRtVbWsYr
  Kampana.A................[AntiTel,Telecom] DgFbFsGjIwJkJwMhRhRfRtRvScWs
  Kaos4....................[...............] AnFsJkMhSc
  Keypress.1232.A..........[Turku,Twins....] DgIwJwRfRrRtSgWsYr
  Leandro..................[...............] JkJwRtSc
  Lemming..................[...............] RrSc
  Liberty.2857.A...........[Mystic,Magic...] FsIwJwRhRfRtWsYr
  Little_Brother.307.......[...............] FsJk
  Little_Red...............[Red Book.......] AnGjJkJwRhRtSc
  MacGyver.2803............[Shoo...........] AnJk
  Maltese Amoeba...........[Grain of Sand..] AnDgFsIwJkJwPpRtSgWsYr
  Mange_Tout.1099..........[...............] DgJkMhRf
  Markt.1533...............[Werbe..........] DgJk
  MIREA.1788...............[Lyceum,Lycee...] EkJk
  Music_Bug................[...............] FsGjJkPpWs
  Necros...................[Gnose,Irish3...] DgJk
  Neuroquila...............[Havoc..........] DgIwJkWs
  NJH2LBC.A................[Korea Boot.....] DgJkYr
  No_Frills.Dudley.........[Oi Dudley......] DgJkRrRt
  No_Frills.No_Frills.843..[...............] JkRrSc
  Nomenklatura.A...........[Nomen..........] DgJkJw
  November_17th.800.A......[Jan1,800.......] LsSc
  November_17th.855.A......[V855...........] DgFsJkJwLsRtSc
  NPox.963.A...............[Evil Genius....] FsSc
  NYB......................[B1.............] AnDgEkFsGjJkJwLsMhRfRtScVbWsYr
  One_Half.................[Dis,Free Love..] CsDgEkIwJkJwLsRtScVbWs
  Ontario.1024.............[SBC,1024.......] JkJwRrSg
  Parity_Boot.B............[Generic 1......] AnCsDgFsGjIwJkJwMhRhRfRtRvScVb
  Pathogen:SMEG.0_1........[...............] DgIwJkWs
  Peter....................[Peter II.......] JwRhJkRf
  Ping_Pong.B..............[Italian........] DgFbIwJkJwLsSgWsYr
  Predator.2448............[2448...........] FsSc
  Print_Screen_Boot.A......[India,PrnSn....] DgJwScYr
  QRry.....................[Query,Essex....] JkJwSc
  Queeg:SMEG.0_1...........[...............] DgJk
  Quox.....................[Stealth 2......] FsJkJwRhRtSc
  Riihi....................[...............] FsMh
  Ripper...................[Jack Ripper....] AnCsDgFsGjJkJwMhRhRfRtScVbWs
  Russian_Flag.............[...............] AnDg
  Sampo....................[Turbo..........] DgFsGjIwJkJwMhRhRfRtScVbWs
  Sat_Bug.Natas............[Satan..........] DgFsJwMhJkRtRvScVbWs
  Sat_Bug.Sat_Bug..........[Satan Bug......] JkJwYr
  Sayha....................[...............] ScYr
  Screaming_Fist.II.696....[Fist 2,Scream 2] DgGjJkJwRtScWs
  Sibylle..................[...............] DgJw
  Sleep_Walker.............[...............] JkRrSc
  Stardot.789.A............[805............] JwLsSc
  Stealth_Boot.B...........[AMSE NopB......] GjIwJkJwPpRhRtScVb
  Stealth_Boot.C...........[AMSE NopB2.....] GjJkJwRtVbYr
  Stoned.16.A..............[Brunswick......] DgJwScYr
  Stoned.Angelina..........[...............] CsDgIwJkJwMhRvSc
  Stoned.Azusa.A...........[Hong Kong......] AnDgFsGjJkJwPpRfRrRtScSgWsYr
  Stoned.Bravo.............[...............] AnJk
  Stoned.Bunny.A...........[...............] AnWs
  Stoned.Dinamo.*..........[...............] RtScYr
  Stoned.Empire.Int_10.B...[...............] JkPpRt
  Stoned.Empire.Monkey.A...[Monkey.........] IwJkJwRrRtSc
  Stoned.Empire.Monkey.B...[Monkey 2.......] AnDgFsGjIwJkJwMhPpRhRfRrRtScVbWs
  Stoned.June_4th.A........[Bloody!,Beijing] DgGjJkRfRrScVbWsYr
  Stoned.Kiev..............[...............] EkJkRt
  Stoned.Lzr...............[Stoned.Whit....] FsGjIwJkJwMhRtScYr
  Stoned.Manitoba..........[Stonehenge.....] DgFsJkJwRtSc
  Stoned.Michelangelo.A....[...............] AnCsDgEkFbFsGjIwJkJwPpRhRfRrRtSc
    (Stoned.Michelangelo continued)            SgVbWsYr
  Stoned.No_INT.A..........[Stoned.........] AnDgFsGjIwJkJwMhRrRtScWsYr
  Stoned.NOP...............[NOP............] DgJkWs
  Stoned.Standard.A........[New Zealand....] AnDgEkFbFsGjIwJkJwLsPpRfRrRtScSg
    (Stoned.Standard continued)                VbWs
  Stoned.Swedish_Disaster..[...............] DgGj
  Stoned.W-Boot............[W-Boot.........] JkRrScWsYr
  SVC.3103.A...............[SVC 5.0........] DgEkRfScSg
  Swiss_Boot...............[Swiss Army.....] FsJkMhRh
  Tai-Pan.483..............[...............] FsIwJkJwMhRtVb
  Tai-Pan.666..............[D2D............] DgEkJkJwMhPpRtWs
  Tequila.A................[...............] CsDgFsIwJkJwLsRfRtScSgVbWsYr
  Three_Tunes.A............[1784...........] GjJkSc
  Trakia.653...............[...............] RrSc
  Tremor.A.................[...............] AnFsIwJkRtVbWs
  Trojector.1463...........[Athens.........] DgFsJkJw
  Urkel....................[Nwait .........] FsJkVbWs
  V-Sign...................[Cansu,Sigalit..] DgFsGjIwJkJwLsMhRhRfRrRtScSgVbWs
    (V-Sign continued)                         Yr
  Vacsina.TP-05.A..........[RCE-1206.......] DgFsGjIwJwRfRtScWs
  Vacsina.TP-16.A..........[RCE-1339.......] DgFsJwRh
  Vampiro..................[...............] DgWs
  Vienna.648.Reboot.A......[DOS-62.........] DgEkJw
  Vinchuca.................[...............] DgWs
  Virogen.Pinworm..........[...............] GjJk
  VLamiX...................[Die Lamer......] DgMhRt
  WelcomB..................[Bupt...........] IwJkJwRt
  WXYC.....................[...............] GjJkJwRhScWs
  Yankee Doodle.TP-39......[RCE-2772.......] DgFs
  Yankee Doodle.TP-44.A....[RCE-2885.......] DgEkFsIwJwLsMhRfRtScVb
  Yankee Doodle.XPEH.4928..[Micropox.......] FsJkYr
 ============================================================================
  Total for main list: 157
 ============================================================================
  This additional list includes viruses reported by a single participant and
  are usually either moving onto the main list, or dropping off of it.

 
  CARO Name of Virus       [Alias(es)      ] Reported by:
 ============================================================================
  2up.6000.................[...............] Ek
  Accept.3773..............[...............] Yr
  Aircop.Standard..........[...............] Oh
  Anarchy.2048.............[...............] Ek
  Anticad.2900.............[Plastique.2900.] Jw
  Bad_Sectors.A............[...............] Yr
  Benito...................[...............] Ls
  Boot-446.................[Pasta..........] Dg
  Bosnia:TPE.1_4...........[...............] Ls
  Bravo.A..................[...............] An
  Cantando.................[...............] Mh
  Cascade.1701.G...........[1701...........] Vb
  Cascade.1704.D...........[1704...........] Fs
  Catholic.................[...............] Mh
  Corgi....................[...............] Dg
  Danish_Tiny.467..........[...............] Fs
  Dark_Avenger.2100.SI.A...[V2100..........] Dg
  Datalock.828.A...........[...............] Yr
  Diamond.1024.B...........[...............] Fs
  Dir_II.5.................[...............] Vb
  Disk_Washer..............[...............] Rh
  DOS_Hunter...............[...............] Jw
  Emmie.3097...............[...............] Yr
  End_of.783...............[...............] Yr
  Error_Vir................[...............] Mh
  EXE_Bug.B................[...............] An
  Filler.A.................[...............] Gj
  Finnish.357..............[...............] Fs
  Freddy_Soft..............[...............] Fs
  Gippo.Epidemic...........[...............] Sc
  Gippo.JumpingJack........[...............] Yr
  HLLC.EXE_Engine..........[...............] Vb
  HLLC.Sauna...............[...............] Fs
  HLLO.Novademo.*..........[...............] Fs
  HLLP.Vova.12560..........[...............] Ek
  Industrial.1841..........[...............] Dg
  ITV.457..................[...............] Oh
  Japanese_Xmas.*..........[Xmas in Japan..] Rf
  Jerusalem.1808.Blank.....[...............] Fs
  Jerusalem.1808.Critical..[...............] Jw
  Jerusalem.1808.F.........[...............] Fs
  Jerusalem.AntiScan.......[...............] Dg
  Jerusalem.Carfield.......[...............] Dg
  Jerusalem.Fu_Manchu.A....[80 2086........] Dg
  Jerusalem.Sunday.II......[Sunday 2.......] Jw
  Keypress.1744............[...............] Yr
  Lame_Surprize.B..........[Lamsurp.B......] Dg
  Mongolian_Boot...........[Mongol.........] Jw
  MISiS....................[Zharinov,NIKA..] Yr
  Necropolis.*.............[1963...........] Yr
  Nice.B...................[...............] Fs
  November_17.768.A........[...............] Ls
  Number_of_the_Beast.E....[512,666........] Fb
  Parity_Boot.A............[...............] Ws
  PG_Boot..................[...............] Jw
  PCBB.1784................[...............] Jw
  Pro......................[KMIT...........] Sc
  Quit.A...................[555,Dutch......] Dg
  Renegade.1176............[...............] Ek
  Rulus....................[...............] Rt
  She_Has..................[...............] Dg
  SillyC.377...............[...............] Yr
  SillyCR.351..............[...............] Yr
  Stardot.600..............[...............] Ls
  Stealth_Boot.Alfredo.....[...............] Jw
  Stealth_Fighter:RDA_20...[...............] Ek
  Stoned.Michelangelo.K....[...............] Yr
  Stoned.New_Zealand.......[...............] Gj
  Storm.1218...............[...............] Yr
  Street_Fighter:RDA.......[Fighter........] Jw
  Swiss_Phoenix............[...............] Yr
  Sword....................[...............] Dg
  Tikka....................[...............] Dg
  VCL.Genocide.981.........[...............] An
  Vmem.....................[...............] Yr
  Voronezh.1600.A..........[RCE-1600.......] Ek
  Yeke.1204................[...............] Ls
 ============================================================================
  Total for both lists: 233
 ============================================================================
  I am currently seeking WildList participants for regional reporting, 
  especially in Central and South America, Spain, former Soviet republics, 
  the Netherlands, China, and Taiwan. Such new participants will need to
  be in a position where they can monitor and verify virus incidents. People
  who develop av products are best suited. People who represent one or more
  av products (agents) and provide localized support may also be qualified
  if they actually verify the viruses or forward samples to developers. If
  you thus qualify, please send your name, location, organization, product
  name, favorite brand of beer, and references (preferably CARO members who
  know you). Send the information to [email protected]. Thanks.
 ============================================================================
  The collation of this list is done by Joe Wells, Virus Specialist at IBM's
  T.J.Watson Research Center, who is solely responsible for its contents.
 
  The material presented is implicitly copyrighted under various laws, but
  may be freely quoted or cited. However, its source and cooperative nature
  should be duly referenced. No permission is needed to reprint this list.

  The latest WildList is always posted by me directly to the NCSA Security
  forum on Compuserve.

 ============================================================================
  WildList Vol 506 - [email protected] - 75511,635 - [email protected]
 ============================================================================
  -----BEGIN PGP PUBLIC KEY BLOCK-----
  Version: 2.7

  mQCNAy+wAnYAAAEEAO2alE3YclXZAxkqrSVXkhAuuOsx6NnVfUdKMghYtrBabFuJ
  +zKiIsahmjeakA2J101KZOHtKMhb5iqLG0oCbRyuBFLtuMhJrjk+L9VRCoxoDB/4
  XwFevOGyxRHYfancrIydlMUooe7TZJqbGhhQEROWYm8v6RvkPFtsMpyD+Lb1AAUR
  tCNKb2UgV2VsbHMgPGMxandlbGxzQHdhdHNvbi5pYm0uY29tPg==
  =aKXf
  -----END PGP PUBLIC KEY BLOCK-----
 ============================================================================