The compilation of a unifed list of computer viruses is made difcult because

of naming. To aid the fght against computer viruses and other types of
malicious software, many security advisory organizations and developers of
anti-virus software compile and publish lists of viruses. When a new virus
appears, the rush begins to identify and understand it as well as develop
appropriate counter-measures to stop its propagation. Along the way, a name
is attached to the virus. As the developers of anti-virus software compete
partly based on how uic!ly they react to the new threat, they usually study
and name the viruses independently. "y the time the virus is identifed, many
names denote the same virus.
Another source of ambiguity in names is that sometimes a virus initially
identifed as a completely new virus is found to be a variation of an earlier
!nown virus, in which cases, it is often renamed. #or e$ample, the second
variation of the %obig worm was initially called &'alyh& but later renamed
&%obig.b&. Again, depending on how uic!ly this happens, the old name may
persist.(n terms of scope, there are two ma)or variants* the list of &in-the-wild&
viruses, which list viruses in active circulation, and lists of all !nown viruses,
which also contain viruses believed not to be in active circulation +also called
&zoo viruses&,. The sizes are vastly di-erent, in-the-wild lists contain a
hundred viruses but full lists contain tens of thousands.
.ist of viruses and related programs/edit0
1irus Alias+es, Types %ubtype (solation 2ate (solation 3rigin
Author 4otes
5678 16'$ 9%-23% 'olymorphic 5::8 #irst virus to
use polymorphic encryption
;< ;8:7 9%-23% 5::8-85 The frst
virus to use stealth
=lo 9%-23% 5::6-58 (nfects .>?>
fles only
A and A 9%-23%
Windows :=@:A
Abra$as Abra$as= 9%-23%
Windows :=@:A 5::B-8; >urope ACD1 group
(nfects D39 fle. 2is! directory listing will be set to the system date
and time when infection occurred.
Acid Acid.7E8, Acid.7E8a, Avatar.Acid.7E8, <eeper.Acid.7E8 9%-23%
Windows :=@:A 5::6 Dorp-F9GH (nfects D39 fle.
2is! directory listing will not be altered.
Acme 23% +Windows := 9%-23%,
Hpon e$ecuting infected >?>, this infects another >?> in current
directory by ma!ing a hidden D39 fle with same base name.
A"D A"D-6BEA, A"D.6BEA, A"D.6:8= 9%-23% 5::6-58
A"D causes !eystro!es on the compromised machine to
be repeated.
Actifed 9%-23%
Ada 9%-23% 5::5-58 Argentina The
Ada virus mainly targets .D39 fles, specifcally D399A42.D39.
AgenaAgena.E6B 9%-23% 5::6-8: %pain
(nfected programs will have a fle length increase of E6B to EBA bytes
AI(-'lan 9onth ;-7 9%-23% 9Jlheim an der Cuhr,
Iermany AI(-'lan is notable for reappearing in %outh Africa
in what appeared to be an intentional re-release.
Ah 2avid-55EB, Tuesday 9%-23% 5::5-8= (taly
%ystems infected with Ah will e$perience freuent system
hangs.
A( 9%-23%
A(2% A(2%", Kahaha, Taunt 9%-23% 5::8 2r.
Loseph 'opp A(2% is the frst virus !nown to e$ploit the 9%-23%
&corresponding fle& vulnerability.
A(2% ((
AirDop Air cop-", Ced %tate 9%-23% 5::8-85
(nfects the boot sector of Moppy dis!s.
Alabama Alabama." 9%-23% 5:A:-58 Kebrew
Hniversity, Lerusalem #iles infected by Alabama increase in size by
5,=78 bytes.
Alcon/50 C%N, <endesm, <enO2esmond, >ther 9%-23% 5::E-
56 3verwrites random information on dis! causing
damage over time.
Ambulance
Anna <ourni!ova >mail
1"%cript 6885-86-55 %nee!, 4etherlandsLan de Wit A
2utch court stated that H%F577,888 in damages was caused by the worm.
AntiD93% 2ue to a bug in the
virus code, the virus fails to erase D93% information as intended.
ACD1-n 9%-23% 5::6-58@5::6-55 >ngland,
Hnited <ingdom ACD1 Iroup ACD1-n is a term for a large family of viruses
written by the ACD1 group.
"omber Dommander"omber 9%-23%
"ulgaria 'olymorphic virus which infects systems by
inserting fragments of its code randomly into e$ecutable fles.
"rain 'a!istani Mu 5:A7-85 .ahore, 'a!istan "asit
and Am)ad #aroo Alvi Donsidered to be the frst computer virus for the 'D
"yte "andit Amiga, "ootsector virus 5:AA-85
%wiss Drac!ing Association (t was one of the most feared Amiga
viruses until the infamous .amer >$terminator.
Dhristmas Tree
D(K Dhernobyl, %pacefller Windows :=@:A@9e Lune 5::A
Taiwan Taiwan Dhen ing-Kau Activates on April 67, in
which it destroys partition tables, and tries to overwrite the "(3%.
Dommwarrior %ymbian "luetooth worm
#amous for being the frst worm to spread via 99% and
"luetooth.
Dreeper T>4>? operating system 5:E5 "ob
Thomas An e$perimental self-replicating program which gained access
via the AC'A4>T and copied itself to the remote system.
>liza 9%-23% 5::5-56
>l! Dloner Apple (( 5:A6 9t. .ebanon, 'ennsylvania,
Hnited %tates 9t. .ebanon, 'ennsylvania, Hnited %tates Cich %!renta
The frst virus observed &in the wild&
#orm 9%-23% 5::8 %witzerland A very
common boot virus, triggers on the 5Ath of any month.
Iraybird Iraybird '
Kare 9%-23%
Windows :=, Windows :A 5::7-8A #amous for
press coverage which blew its destructiveness out of proportion
(.31>N3H 6888-8=-8= 9anila, 'hilippines
Ceomel Camores, 3nel de Iuzman A computer worm that attac!ed
tens of millions of Windows personal computers
(4(T 5:A; 9ac 3% 5::6-8B-5B
9alicious, triggered on #riday the 5Bth.
Lerusalem 23% 5:AE-58 Lerusalem
was initially very common and spawned a large number of variants.
<ama %utra "lac!worm, 4y$em, and "lac!mal 6887-85-57
2esigned to destroy common fles such as 9icrosoft
Word, >$cel, and 'ower'oint documents.
<o!o 23% 5::5-8B The payload of this
virus activates on Luly 6: and #ebruary 5= and may erase data on the users
hard drive
.amer >$terminator Amiga, "oot sector virus 5:A:-58
Iermany Candom encryption, flls random sector with
&.A9>C&
9ac9ag 2rew, "radow, Aldus, 'eace 5:AE-56
92># Iarfeld, Top Dat 5::8-8=
9elissa 9ailissa, %impsons, <wy)ibo, <we)eebo 9icrosoft Word macro
virus 5:::-8B-67 4ew Lersey, Hnited %tates2avid .. %mith
'art macro virus and part worm. 9elissa, a 9% Word-based macro that
replicates itself through e-mail.
9ichelangelo 9%-23% 5::5-86-8; Australia
Can 9arch 7 +9ichelangeloPs birthday,
4avidad 6888-56
4atas 9ultipartite, stealth, 'olymorphic 5::;
&'riest&
n1(C 9329, nDA9, n#.H, !33., Kpat, Lude 9ac 3% 5:AE
n1(C has been !nown to PhybridizeP with di-erent variants
of n1(C on the same machine.
3neKalf %lova! "omber, #reelove or >$plosion-(( 9%-23%
5::; %lova!ia 1yvo)ar (t is also !nown as one of the
frst viruses to implement a techniue of &patchy infection&
3ntario.586;
3ntario.68;A
3ntario %"D 9%-23% 5::8-8E 3ntario, Danada
2eath Angel
'i!achu virus 6888-87-6A Asia The
'i!achu virus is believed to be the frst computer virus geared at children.
'ing-pong "oot, "ouncing "all, "ouncing 2ot, (talian, (talian-A, 1eraDruz
"oot sector virus Karmless to most
computers
Cav9on>.e$e CLump.A, Ca)ump, Lis$ Worm 6887-87-68
3nce distributed in Apple i'ods, but a Windows-only virus
%DA Amiga, "oot sector virus 5:AE-55 %witzerland
%wiss Drac!ing Association 'uts a message on screen. Karmless
e$cept it might destroy a legitimate non-standard boot bloc!.
%cores >ric, 1ult, 4A%A, %an Lose #lu 9ac 3% 5:AA %pring
2esigned to attac! two specifc applications which
were never released.
%cottPs 1alley 9%-23% 5::8-8: %cotts 1alley,
Dalifornia, Hnited %tates (nfected fles will contain the
seemingly meaningless he$ string =>A"2>:8:8A5D7B688":568A6>.
%even2ust 777, 92>#, :A87, Iraphics Accelerator, %even2 9ac 3%
5::A
%han!arPs 1irus W:E9.9ar!er.o 'olymorphic 1irus 5:::-87-8B
%am Cogers (nfects Word 2ocuments
%imile >tap, 9eta'K3C Windows 'olymorphic The
9ental 2riller The metamorphic code accounts for around :8Q of the
virusP code
%9>I engine 9%-23% 'olymorphic 5::; Hnited
<ingdom The "lac! "aron Two viruses were created using the engine*
'athogen and Rueeg.
%toned 5:AE Wellington, 4ew Gealand
3ne of the earliest and most prevalent boot sector viruses
%unday 9%-23% Lerusalem.%unday 5:A:-55 %eattle,
Washington, Hnited %tates "ecause of an error in coding,
the virus fails to e$ecute its payload.
T2.-; "otnet L2 virus
Techno 9%-23% The virus
plays a tune that was created by the author of the virus
Whale 9%-23% 'olymorphic 5::8-8E-85 Kamburg,
Iermany C Komer At :657 bytes, was for its time the largest virus
ever discovered.
G9ist G9istfall, Gombie.9istfall Gombie.9istfall
G8mbie (t was the frst virus to use a techniue !nown as &code
integration&.