Comparison of computer viruses

Last updated

Creating a unified list of computer viruses is challenging due to inconsistent naming conventions. To combat computer viruses and other malicious software, many security advisory organizations and anti-virus software developers compile and publish virus lists. When a new virus appears, the rush begins to identify and understand it as well as develop appropriate counter-measures to stop its propagation. Along the way, a name is attached to the virus. Since anti-virus software compete partly based on how quickly they react to the new threat, they usually study and name the viruses independently. By the time the virus is identified, many names have been used to denote the same virus.

Contents

Ambiguity in virus naming arises when a newly identified virus is later found to be a variant of an existing one, often resulting in renaming. For example, the second variation of the Sobig worm was initially called "Palyh" but later renamed "Sobig.b". Again, depending on how quickly this happens, the old name may persist.

Scope

In terms of scope, there are two major variants: the list of "in-the-wild" viruses, which list viruses in active circulation, and lists of all known viruses, which also contain viruses believed not to be in active circulation (also called "zoo viruses"). The sizes are vastly different: in-the-wild lists contain a hundred viruses but full lists contain tens of thousands.

VirusAlias(es)TypesSubtypeIsolation dateIsolationOriginAuthorNotes
1260 V2Px DOS Polymorphic [1] 1990First virus family to use polymorphic encryption
4K 4096DOS1990-01The first known MS-DOS-file-infector to use stealth
5lo DOS1992-10Infects .EXE files only
Abraxas Abraxas5DOS,
Windows 95, 98
[1] 1993-04 Europe ARCV groupInfects COM file. Disk directory listing will be set to the system date and time when infection occurred.
Acid Acid.670, Acid.670a, Avatar.Acid.670, Keeper.Acid.670DOS,
Windows 95, 98
1992Corp-$MZUInfects COM file. Disk directory listing will not be altered.
Acme DOS,
Windows 95 DOS
1992Upon executing infected EXE, this infects another EXE in current directory by making a hidden COM file with same base name.
ABC ABC-2378, ABC.2378, ABC.2905DOS1992-10ABC causes keystrokes on the compromised machine to be repeated.
Ada DOS1991-10 Argentina The Ada virus mainly targets .COM files, specifically COMMAND.COM.
AGI-Plan Month 4-6DOS Mülheim AGI-Plan is notable for reappearing in South Africa in what appeared to be an intentional re-release.
AIDS AIDSB, Hahaha, TauntDOS1990AIDS is the first virus known to exploit the DOS "corresponding file" vulnerability.
AIDS II DOScirca 1990
Alabama Alabama.BDOS1989-10 Hebrew University, JerusalemFiles infected by Alabama increase in size by 1,560 bytes.
Alcon [1] RSY, Kendesm, Ken&Desmond, EtherDOS1997-12Overwrites random information on disk causing damage over time.
Ambulance DOSJune 1990
Anna Kournikova Email
VBScript
2001-02-11 Sneek, NetherlandsJan de WitA Dutch court stated that US$166,000 in damages was caused by the worm.
ANTI ANTI-A, ANTI-ANGE, ANTI-B, Anti-VariantClassic Mac OS1989-02 France The first Mac OS virus not to create additional resources; instead, it patches existing CODE resources.
AntiCMOS DOSJanuary 1994 – 1995Due to a bug in the virus code, the virus fails to erase CMOS information as intended.
ARCV-n DOS1992-10/1992-11 England, United KingdomARCV GroupARCV-n is a term for a large family of viruses written by the ARCV group.
Alureon TDL-4, TDL-1, TDL-2, TDL-3, TDL-TDSSWindows Botnet 2007 Estonia JD virus
AutostartAutostart.A—DClassic Mac OS1998 Hong Kong China
Bonzi Buddy Bomber, CommanderBomberDOS Bulgaria Polymorphic virus which infects systems by inserting fragments of its code randomly into executable files.
Brain Pakistani flu DOSBoot sector virus1986-01 Lahore, Pakistan Basit and Amjad Farooq Alvi Considered to be the first computer virus for the PC
Byte Bandit AmigaBoot sector virus1988-01 Swiss Cracking Association It was one of the most feared Amiga viruses until the infamous Lamer Exterminator.
CDEFClassic Mac OS1990.08 Ithaca, New York Cdef arrives on a system from an infected Desktop file on removable media. It does not infect any Macintosh systems beyond OS6.
Christmas Tree Worm1987-12 Germany
CIH Chernobyl, Spacefiller Windows 95, 98, Me 1998-06 Taiwan Taiwan Chen ing-HauActivates on April 26, in which it destroys partition tables, and tries to overwrite the BIOS.
Commwarrior Symbian Bluetooth wormFamous for being the first worm to spread via MMS and Bluetooth.
Creeper TENEX operating system Worm1971Bob ThomasAn experimental self-replicating program which gained access via the ARPANET and copied itself to the remote system.
Eliza DOS1991-12
Elk Cloner Apple II 1982 Mt. Lebanon, Pennsylvania Mt. Lebanon, PennsylvaniaRich SkrentaThe first virus observed "in the wild"
Esperanto Esperanto.4733DOS, MS Windows, Classic Mac OS1997.11 Spain Spain Mister SandmanFirst multi-processor virus. The virus is capable of infecting files on computers running Microsoft Windows and DOS on the x86 processor and MacOS, whether they are on a Motorola or PowerPC processor.
Fakesysdef2010 Trojan targeting the Microsoft Windows operating system. Dispersed as an application called "HDD Defragmenter", a fake system defragmenter.
Form DOS1990 Switzerland A very common boot virus, triggers on the 18th of any month.
Fun Windows2008It registers itself as a Windows system process then periodically sends mail with spreading attachments as a response to any unopened emails in Outlook Express
Graybird Backdoor.GrayBird, BackDoor-ARRWindowsTrojan Horse2003-02-04
Hare DOS,
Windows 95, Windows 98
1996-08Famous for press coverage which blew its destructiveness out of proportion
ILOVEYOU MicrosoftWorm2000-05-05 Manila, Philippines Michael Buen, Onel de GuzmanComputer worm that attacked tens of millions of Windows personal computers
INIT 1984 Classic Mac OS1992-03-13 Ireland Malicious, triggered on Friday the 13th. Init1984 works on Classic Mac OS System 6 and 7.
Jerusalem Sunday, Jerusalem-113, Jeruspain, Suriv, Sat13, FuManchuDOSFile virus1987-10 Seattle Jerusalem was initially very common and spawned a large number of variants.
Kama Sutra Blackworm, Nyxem, and Blackmal2006-01-16Designed to destroy common files such as Microsoft Word, Excel, and PowerPoint documents.
Koko DOS1991-03The payload of this virus activates on July 29 and February 15 and may erase data on the users hard drive
Lamer Exterminator AmigaBoot sector virus1989-10 Germany Random encryption, fills random sector with "LAMER"
MacMag Drew, Bradow, Aldus, PeaceClassic Mac OS1987-12 United States Products (not necessarily the Classic Mac OS) were infected with the first actual virus.
MDEF Garfield, Top CatClassic Mac OS1990-05-15
Ithaca, New York Infects menu definition resource fork files. Mdef infects all Classic Mac OS versions from 4.1 to 6.
Melissa Mailissa, Simpsons, Kwyjibo, Kwejeebo Microsoft Word macro virus1999-03-26 New Jersey David L. SmithPart macro virus and part worm. Melissa, a MS Word-based macro that replicates itself through e-mail.
MiraiInternet of ThingsDDoS2016
Michelangelo DOS1991-02-04 Australia Ran March 6 (Michelangelo's birthday)
Mydoom Novarg, Mimail, ShimgapiWindowsWorm2004-01-26World Russia Mydoom was the world's fastest spreading computer worm to date, surpassing Sobig, and the ILOVEYOU computer worms, yet it was used to DDoS servers.
Navidad WindowsMass-mailer worm2000-12 South America
Natas Natas.4740, Natas.4744, Natas.4774, Natas.4988DOSMultipartite, stealth, polymorphic1994.06 Mexico City United States Priest (AKA Little Loc)
nVIR MODM, nCAM, nFLU, kOOL, Hpat, Jude, Mev#, nVIR.BClassic Mac OS1987-12 United States nVIR has been known to 'hybridize' with different variants of nVIR on the same machine.
OompaLeapMac OSXWorm2006.02.10First worm for Mac OSX. It propagates through iChat, an instant message client for Macintosh operating systems. Whether Oompa is a worm has been controversial. Some believe it is a trojan.
OneHalf Slovak Bomber, Freelove or Explosion-IIDOS1994 Slovakia VyvojarIt is also known as one of the first viruses to implement a technique of "patchy infection"
NoEscape.exeWindows
Ontario.1024
Ontario.2048
Ontario SBCDOS1990-07 Ontario "Death Angel"
Petya GoldenEye, NotPetyaWindowsTrojan horse2016 Ukraine Russia Total damages brought about by NotPetya to more than $10 billion.
Pikachu virus 2000-06-28 Asia The Pikachu virus is believed to be the first computer virus geared at children.
Ping-pong Boot, Bouncing Ball, Bouncing Dot, Italian, Italian-A, VeraCruzDOSBoot sector virus1988-03 Turin Harmless to most computers
RavMonE.exe RJump.A, Rajump, JisxWorm2006-06-20Once distributed in Apple iPods, but a Windows-only virus
SCA AmigaBoot sector virus1987-11 Switzerland Swiss Cracking Association Puts a message on screen. Harmless except it might destroy a legitimate non-standard boot block.
Scores Eric, Vult, NASA, San Jose Flu Classic Mac OS 1988.04 United States Fort Worth, Texas Donald D. BurlesonDesigned to attack two specific applications which were never released.
Scott's Valley DOS1990-09 Scotts Valley, California Infected files will contain the seemingly meaningless hex string 5E8BDE909081C63200B912082E.
SevenDust 666, MDEF, 9806, Graphics Accelerator, SevenD, SevenDust.B—GClassic Mac OSPolymorphic1989-06
MarkerShankar's Virus, Marker.C, Marker.O, Marker.Q, Marker.X, Marker.AQ, Marker.BN, Marker.BO, Marker.DD, Marker.GR, W97M.MarkerMS WordPolymorphic, Macro virus1999-06-03Sam RogersInfects Word Documents
Simile Etap, MetaPHORWindowsPolymorphicThe Mental DrillerThe metamorphic code accounts for around 90% of the virus' code
SMEG engine DOSPolymorphic1994 United Kingdom The Black BaronTwo viruses were created using the engine: Pathogen and Queeg.
Stoned DOSBoot sector virus1987 Wellington One of the earliest and most prevalent boot sector viruses
WannaCry WannaCrypt, WannaCryptorWindowsRansomware Cryptoworm2017World North Korea
WDEFWDEF AClassic Mac OS1989.12.15Given the unique nature of the virus, its origin is uncertain.
Whale DOSPolymorphic1990-07-01 Hamburg R HomerAt 9216 bytes, was for its time the largest virus ever discovered.
ZMist ZMistfall, Zombie.MistfallWindows2001 Russia Z0mbieIt was the first virus to use a technique known as "code integration".
Xafecopy AndroidTrojan2017
ZucZuc.A., Zuc.B, Zuc.CClassic Mac OS1990.03 Italy Italy

Unusual subtypes

Notable instances

Similar software

Security topics

See also

References

  1. 1 2 3 Vincentas (11 July 2013). "Computer Viruses in SpyWareLoop.com". Spyware Loop. Archived from the original on 21 September 2013. Retrieved 28 July 2013.

Conclusion

Due to the continuous evolution of computer viruses and malware, virus naming conventions and classifications will continue to present challenges, making standardized virus databases essential for global cybersecurity.