List of computer worms

Last updated

NameAlias(es)TypeSubtypeIsolation dateIsolationOriginAuthorNotes
Badtrans Mass mailerNovember 24, 2001Installed a keylogger; distributed logged information
Bagle Beagle, Mitglieder, LodeightJanuary 18, 2004Mass mailer
Blaster LovesanAugust 11, 2003Gruel.exe Makes all exe's unusable so the computer probably can't reboot Hopkins, Minnesota Jeffrey Lee ParsonTargeted toward Bill Gates; contained message "billy gates why do you make this possible ? Stop making money and fix your software!!"
Brontok W32/Rontokbro.gen@MM, W32.Rontokbro@mm, BackDoor.Generic.1138, W32/Korbo-B, Worm/Brontok.a, Win32.Brontok.A@mm, Worm.Mytob.GH, W32/Brontok.C.worm, and Win32/Brontok.E, W32.Rontokbro.D@mm.October 3, 2005 Indonesia Spread through an Indonesian e-mail headed with "stop the collapse in this country"; destroys firewalls
BuluBebek W32/VBWorm.QXEOctober 10, 2008
Code Red DoS payload, Defacement payloadJuly, 2001Exploited Microsoft Internet Information Services to deface web pages and DOS a few set IPs.
Daprosy Worm Worm.Win32.VB.arz, W32.Autorun.worm.h, W32/Autorun-AMS, Worm:Win32/Autorun.UDTrojan wormMass mailerJuly 15, 2009Replaces folders with .EXE's, key logger, slow mass mailer
Code Red II August 4, 2001Exploited Microsoft Internet Information Server security holes.
Dabber W32/Dabber-C, W32/Dabber.AMay 14, 2004
Doomjuice Feb 11, 2004Attack computers that had previously been infected by the Mydoom worm.
ExploreZip I-Worm.ZippedFilesJune 6, 1999Spread through zipped documents in a spam e-mail.
Father Christmas HI.COMDecember 1988
Hybris Snow White, Full Moon, Vecna.22528December 11, 2000 Brazil VecnaSpread through an e-mail from "haha@sexyfun.net"
ILOVEYOU Loveletter, LoveBugWormMay 4, 2000 Manila, Philippines
Kak worm October 22, 1999On the first day of any month, if the time was after 5pm, Kak displayed a popup message box that read: "Driver Memory Error - Kagou-Anti-Kro$oft says not today !" Dismissing it would reboot the computer and then display the message again.
Klez October 2001
Koobface December 2008Targeted MySpace and Facebook users with a heading of "Happy Holidays"
Leap-A Oompa-LoompaTrojan wormFebruary 14, 2006Most known for being the first virus targeting Mac computers.
Morris November 2, 1988 Robert Tappan Morris Widely considered to be the first computer worm. Although created for academic purposes, the negligence of the author unintentionally caused the worm to act as a denial of service attack. It spread by exploiting known vulnerabilities in UNIX-based systems, cracked weak passwords, and periodically altered its process ID to avoid detection by system operators.
Mydoom W32.MyDoom@mm, Novarg, Mimail.R, ShimgapiJanuary 26, 2004Fastest-spreading e-mail worm known; used to attack SCO Group.
Mylife W32.MyLife.C@mmApril 2, 2002
Navidad
Netsky February 18, 2004 Germany Sven Jaschan
Nimda September 2001Originally suspected to be connected to Al Qaeda because of release date; uses multiple infection vectors
Sadmind May 8, 2001
Sasser Big OneApril 30, 2004 Sven Jaschan Network worm. At startup, it kills the process lsass.exe, a windows process which handles file permissions. Killing lsass causes the computer to reboot one minute later, which would cause sasser to run again. This would continue in an infinite loop until the computer is shut down manually.
Sircam Spread through e-mail with text like "I send you this file in order to have your advice."
Sober CME-681, WORM_SOBER.AGOctober 24, 2003 Germany, possibly from National Democratic Party of Germany Was disguised as e-mail from United States government.
Sobig August 2003
SQL Slammer DDOS.SQLP1434.A, the Sapphire Worm, SQL_HEL, W32/SQLSlammerCaused global Internet slowdown
Stuxnet Win32/StuxnetJune 2010First malware to attack SCADA systems.
Swen September 18, 2003
Toxbot 2005 The Netherlands Opened up a backdoor to allow command and control over the IRC network
Upering Annoyer.B, SanyJuly 22, 2003
Voyager VoyagerWormOctober 31, 2005Targets Operating System running Oracle Databases
W32.Alcra.F Win32/Alcan.IWormFebruary 17, 2006Propagated through file-share networks. [1]
W32/Bolgimo.worm
W32/IRCbot.worm W32/Checkout, W32.Mubla, W32/IRCBot-WB, and Backdoor.Win32.IRCBot.aaqTrojan WormBackdoorJune 1, 2007It provides a backdoor server and allows a remote intruder to gain access and control over the computer via an IRC channel.
WANK OILZOctober 1989Spread a pacifist, anti-nuclear political message
Welchia Nachia, NachiA helpful worm meant to install security patches and removes Blaster worm if the computer is infected by it.
Witty March 19, 2004Appeared very rapidly after announcement of Internet Security Systems vulnerability
Zotob Farid Essebar and Atilla Ekici

See also

Related Research Articles

<span class="mw-page-title-main">Computer worm</span> Self-replicating malware program

A computer worm is a standalone malware computer program that replicates itself in order to spread to other computers. It often uses a computer network to spread itself, relying on security failures on the target computer to access it. It will use this machine as a host to scan and infect other computers. When these new worm-invaded computers are controlled, the worm will continue to scan and infect other computers using these computers as hosts, and this behaviour will continue. Computer worms use recursive methods to copy themselves without host programs and distribute themselves based on the law of exponential growth, thus controlling and infecting more and more computers in a short time. Worms almost always cause at least some harm to the network, even if only by consuming bandwidth, whereas viruses almost always corrupt or modify files on a targeted computer.

<span class="mw-page-title-main">Malware</span> Malicious software

Malware is any software intentionally designed to cause disruption to a computer, server, client, or computer network, leak private information, gain unauthorized access to information or systems, deprive access to information, or which unknowingly interferes with the user's computer security and privacy. By contrast, software that causes harm due to some deficiency is typically described as a software bug. Malware poses serious problems to individuals and businesses on the Internet. According to Symantec's 2018 Internet Security Threat Report (ISTR), malware variants number has increased to 669,947,865 in 2017, which is twice as many malware variants as in 2016. Cybercrime, which includes malware attacks as well as other crimes committed by computer, was predicted to cost the world economy $6 trillion USD in 2021, and is increasing at a rate of 15% per year.

The Morris worm or Internet worm of November 2, 1988, is one of the oldest computer worms distributed via the Internet, and the first to gain significant mainstream media attention. It resulted in the first felony conviction in the US under the 1986 Computer Fraud and Abuse Act. It was written by a graduate student at Cornell University, Robert Tappan Morris, and launched on November 2, 1988, from the Massachusetts Institute of Technology network.

Klez is a computer worm that propagates via e-mail. It first appeared in October 2001. A number of variants of the worm exist.

<span class="mw-page-title-main">Timeline of computer viruses and worms</span> Computer malware timeline

This timeline of computer viruses and worms presents a chronological timeline of noteworthy computer viruses, computer worms, Trojan horses, similar malware, related research and events.

The Melissa virus is a mass-mailing macro virus released on or around March 26, 1999. It targets Microsoft Word and Outlook-based systems and created considerable network traffic. The virus infects computers via email; the email is titled "Important Message From," followed by the current username. Upon clicking the message, the body reads, "Here's that document you asked for. Don't show anyone else ;)." Attached is a Word document titled "list.doc," containing a list of pornographic sites and accompanying logins for each. It then mass-mails itself to the first fifty people in the user's contact list and disables multiple safeguard features on Microsoft Word and Microsoft Outlook.

The Sobig Worm was a computer worm that infected millions of Internet-connected, Microsoft Windows computers in August 2003.

mydoom also known as, my.doom, W32.MyDoom@mm, Novarg, Mimail.R, Shimgapi, W32/Mydoom@MM, WORM_MYDOOM, Win32.Mydoom is a computer worm affecting Microsoft Windows. It was first sighted on January 26, 2004. It became the fastest-spreading e-mail worm ever, exceeding previous records set by the Sobig worm and ILOVEYOU, a record which as of 2022 has yet to be surpassed.

The compilation of a unified list of computer viruses is made difficult because of naming. To aid the fight against computer viruses and other types of malicious software, many security advisory organizations and developers of anti-virus software compile and publish lists of viruses. When a new virus appears, the rush begins to identify and understand it as well as develop appropriate counter-measures to stop its propagation. Along the way, a name is attached to the virus. As the developers of anti-virus software compete partly based on how quickly they react to the new threat, they usually study and name the viruses independently. By the time the virus is identified, many names denote the same virus.

Netsky is a prolific family of computer worms which affect Microsoft Windows operating systems. The first variant appeared on Monday, February 16, 2004. The "B" variant was the first family member to find its way into mass distribution. It appeared on Wednesday, February 18, 2004. 18-year-old Sven Jaschan of Germany confessed to having written these, and other worms, such as Sasser.

ILOVEYOU, sometimes referred to as Love Bug or Love Letter for you, is a computer worm that infected over ten million Windows personal computers on and after 5 May 2000. It started spreading as an email message with the subject line "ILOVEYOU" and the attachment "LOVE-LETTER-FOR-YOU.TXT.vbs." At the time, Windows computers often hid the latter file extension by default because it is an extension for a file type that Windows knows, leading unwitting users to think it was a normal text file. Opening the attachment activates the Visual Basic script. First, the worm inflicts damage on the local machine, overwriting random files, then, it copies itself to all addresses in the Windows Address Book used by Microsoft Outlook, allowing it to spread much faster than any other previous email worm.

Computer fraud is a cybercrime and the act of using a computer to take or alter electronic data, or to gain unlawful use of a computer or system. In the United States, computer fraud is specifically proscribed by the Computer Fraud and Abuse Act, which criminalizes computer-related acts under federal jurisdiction.

Mobile malware is malicious software that targets mobile phones or wireless-enabled Personal digital assistants (PDA), by causing the collapse of the system and loss or leakage of confidential information. As wireless phones and PDA networks have become more and more common and have grown in complexity, it has become increasingly difficult to ensure their safety and security against electronic attacks in the form of viruses or other malware.

Zotob is a computer worm which exploits security vulnerabilities in Microsoft operating systems like Windows 2000, including the MS05-039 plug-and-play vulnerability. This worm has been known to spread on Microsoft-ds or TCP port 445.

The Nimda virus is a malicious file-infecting computer worm. It quickly spread, surpassing the economic damage caused by previous outbreaks such as Code Red.

<span class="mw-page-title-main">Conficker</span> Computer worm

Conficker, also known as Downup, Downadup and Kido, is a computer worm targeting the Microsoft Windows operating system that was first detected in November 2008. It uses flaws in Windows OS software and dictionary attacks on administrator passwords to propagate while forming a botnet, and has been unusually difficult to counter because of its combined use of many advanced malware techniques. The Conficker worm infected millions of computers including government, business and home computers in over 190 countries, making it the largest known computer worm infection since the 2003 Welchia.

<span class="mw-page-title-main">Happy99</span> Windows computer worm and early e-mail virus

Happy99 is a computer worm for Microsoft Windows. It first appeared in mid-January 1999, spreading through email and usenet. The worm installs itself and runs in the background of a victim's machine, without their knowledge. It is generally considered the first virus to propagate by email, and has served as a template for the creation of other self-propagating viruses. Happy99 has spread on multiple continents, including North America, Europe, and Asia.

Anna Kournikova was a computer virus that spread worldwide on the Internet in February 2001. The virus program was contained in an email attachment, purportedly an image of tennis player Anna Kournikova.

<span class="mw-page-title-main">Pikachu virus</span> Computer email worm geared to children

The Pikachu virus, sometimes referred to as Poké Virus, was a computer worm believed to be the first malware geared at children due to its incorporation of Pikachu from the Pokémon series. It was released on June 28, 2000, and arrived in the form of an email titled "Pikachu Pokemon" [sic] with the body of the e-mail containing the text "Pikachu is your friend." Opening the attached executable shows users an image of Pikachu, along with a message stating: "Between millions of people around the world I found you. Don’t forget to remember this day every time MY FRIEND!" The worm itself appeared in the attachment to the email as a file named "PikachuPokemon.exe".

The Stars virus is a computer virus which infects computers running Microsoft Windows. It was named and discovered by Iranian authorities in April 2011. Iran claimed it was used as a tool to commit espionage. Western researchers came to believe it is probably the same thing as the Duqu virus, part of the Stuxnet attack on Iran.

References

  1. "W32.Alcra.F". Symantec. Retrieved 20 October 2016.