============================================================================ PC Viruses in the Wild - May, 1999 ============================================================================ This is a cooperative listing of viruses reported as being in the wild by 50 virus information professionals. The basis for these reports are virus incidents where a sample was received, and positively identified by the participant. Rumors and unverified reports have been excluded. This report is cumulative. That is, this is not just a report of which viruses were seen last month. Monthly data is received from most participants, but the new data is added to the old. Participants are expected to let us know when to remove their name from a virus that they haven't seen in 6 months or so. The list should not be considered a list of "the most common viruses", however, since no specific provision is made for a commonness factor. This data indicates only "which" viruses are in the wild, but viruses reported by many (or most) participants are obviously widespread. The WildList is currently being used as the basis for in-the-wild virus testing and certification of anti-virus products by the ICSA, Virus Bulletin and Secure Computing. Additionally, a virus collection based upon the WildList is being used in an effort to standardize the naming of common viruses. The WildList - (c)1993-1999 by Joe Wells - info@wildlist.org ============================================================================ Key Participant Region Organization Product ============================================================================ Ac Alan Candy New Zealand Applied Insight - Ad Allan Dyer Hong Kong Yui Kee Co. Ltd. F-Prot Ae Amir Elbaz Israel EliaShim ViruSafe Ak Ahmad Y. Kashoor Syria CompuKashoor Dr Solomon's Cb Carl Bretteville Norway Norman ASA NVC Cr Costin RAIU Romania GeCAD RAV Cs Christian Schmid Austria DataPROT Linz F-Prot Dc Dave Chess USA IBM NAV Dg Dmitry Gryaznov UK McAfee (US) VirusScan Ek Eugene Kaspersky Russia KAMI AVP Ev Eduardo Velasquez Colombia/Vene. SOFTEAM Ltda VirusCOP Ew Eddy Willems Belgium/Lux. Data Alert Int'l VirusScan Fh Fraser Howard UK Virus Bulletin - Fl Ferenc Leitold Hungary Hunix Ltd. Virus Buster Fp Francois Paget France McAfee (France) VirusScan Gc Grover Cordova Peru PER Systems PER Antivirus Gm Gerard Mannig France RECIF None Ic Ieta Chi Taiwan Trend Micro PC-cillin Jd Joost de Raeymaeker Portugal RSVP VirusScan Jk Jimmy Kuo USA Independent - Jm Jose Martinez Peru HackSoft S.R.Ltda TH AV Jr Joon Radley So Africa CSIR Virus Lab VPS Jw Jon Wheat USA ICSA - Kb Kenneth Bechtel USA Team Anti-Virus - Kd K. T. Davies India Pioneer Micro Vaxine Ks Klas Scholdstrom Sweden McAfee VirusScan Ls Luca Sambucci Italy Itaweb None Ml Mickey Loh Malaysia R.E.Solutions Armour AV Ms Marek Sell Poland Marek Sell, Ltd. MkS_vir Mt Miroslav Trnka Slovakia ESET Ltd NOD-ICE Oz Jakub Kaminski Australia CYBEC VET Pb Pavel Baudis Czech Republic ALWIL Software Avast! Pn Patrick Nolan USA McAfee (US) VirusScan Ps Peter Szor Finland Data Fellows F-Prot Pro Ra Ruben Arias Argentina RALP Integ Master Rf Richard Foley Ireland Reflex Magnetics TBAV Rp Ronnie Pineda Philippines Mannasoft Corp. VirusScan Rv Robert Vibert Canada Sensible Security - Rz Righard Zwienenberg Netherlands ESaSS BV ThunderBYTE Sb Sherra Buzzell USA Symantec NAV Sm Seiji Murakami Japan JCSR None So Simon Borduas Canada DOLFIN Dev. Ltd F-Prot Pro Sr Subramanya Rao India Proland Software Protector Plus St Stuart Taylor UK Sophos Plc. Sweep Td Toralv Dirro Germany U of Hamburg VirusScan Ti Torben Immisch Denmark Swanholm Distrib. NAV Tm Taras Malivanchuk Israel iRiS Software AntiVirus Plus Ws Wolfgang Stiller USA Stiller Research Integ Master Xc Xabier Cazalis Spain Panda Software Panda Za Corporate #1 Western USA - - ============================================================================ The WildList ============================================================================ This main list includes viruses reported by multiple participants, which appear to be non-regional in nature. Technically, this first list is "the" WildList according to original specification, which required viruses to be verified in the wild by a minimum of two participants. A supplemental list follows that contains viruses reported by single participants. + Viruses marked with a plus sign (+) are new to the main list this month. List Reported Name of Virus [Alias(es) ] Date by: ============================================================================ 15_Years.C..............[Esto te pasa...] 10/97 AcAeEvPnWs AntiCMOS.A..............[Lenart.........] 1/95 AcAkCbCsDcDgEvEwFhFlFpIcJd JrKsMlMsOzPbStPnPsSbSmWs AntiCMOS.B..............[LiXi...........] 10/95 CbKsMsRzSbTd AntiEXE.A...............[D3.............] 9/94 AcAkCbCsDcDgEkEvEwFhFpIcJm KsLsMsOzPbStPnPsRaRfRvRzSm TdTmWsXc Boot-437.A..............[Bath...........] 3/94 CbFlIcKdMsPbStPnRzTdWs Burglar.1150.A..........[GranGrave.1150.] 2/96 CbEkIcKsMsPbPsRzTdWs Byway.A.................[Dir2.Byway.....] 9/95 DgEvJdJmPnSb Cascade.1701.A..........[1701...........] 9/93 CbCsFlKsStPsRzSmTdWs Cascade.1704.A..........[1704...........] 7/93 CsEkEwKs Crazy_Boot..............[...............] 5/95 PnSbTd Cruel.A.................[...............] 2/98 MsPsRzTd DelWin.mp.1759.A........[Goblin.1759....] 6/95 CbDgMsStRfTdTi Diablo_Boot.............[...............] 10/95 EvStRa Die_Hard.4000.A.........[DH2, Wix.......] 1/95 AkCbCrFlIcJrKdKsPnRzTdWs Dir-II.A................[Creeping Death.] 7/93 FlWs Eco.B...................[Eco.B, Sevilla.] 3/98 FpJmStXc Edwin...................[...............] 10/96 CbKs Empire.Monkey.A.........[Monkey.........] 7/94 DcFpIcKsOzStPnRfSb Empire.Monkey.B.........[Monkey 2.......] 7/94 AcCbDcDgEvEwFhFpIcJdJrKsSt PnPsRvRzSbSmTdWsXc EXE_Bug.A...............[CMOS Killer....] 9/93 DgEwFlJdKsStPnRfTdWs Flip.mp.2153.A..........[Omicron........] 7/93 FpXc Form.A..................[Form 18........] 7/94 AcCbCsDcEvEwFhFlFpJmJrKsLs MsPbStPnPsRfRzSbSmTdTiWsXc Form.D..................[Form May.......] 7/94 CsEvFpStSb Green_Caterpillar.1575.A[Find, 1575.....] 7/93 DgPnWs J&M.A...................[Jimi,Hasita....] 6/95 CbKsMtPbStPnSm Jerusalem.1808.Standard.[Israeli........] 7/93 CbCsDgFlFpIcRzWs Jumper.B................[...............] 4/99 AkFp Junkie.mp.1027.A........[DrWhite.1027...] 7/94 AcCbCsDcDgEkEwFhFlFpKsLsMs OzPbStPnPsRfRzSbTdTiWsXc Kampana.mp.A............[AntiTel........] 7/93 CbJd Major.1644.A............[Major BBS......] 6/96 AeCbEkKsMsPbPnPsRzTd Manzon.1426.............[...............] 5/96 CbKsMsStPnPsTd Michelangelo.A..........[...............] 7/93 CsSbWs Natas.mp.4774...........[Satan..........] 10/95 CbDgEvIcJdJmJrKdMsPbStPnPs RfSbTdXc Nightfall.4518..........[N8Fal..........] 2/96 CbPbPnTd NYB.A...................[B1.............] 7/94 AcDcEkEwFhFlJrKsLsMsStPnPs RzSbSmSrTdWsXc +O97M/Jerk.B.............[...............] 5/99 KsPn O97M/Tristate.C.........[...............] 4/99 CrDgEwKbKsOzPnPsSm One_Half.mp.3544.A......[Dis, Free Love.] 10/95 AcAeAkCbCrCsDgEkEvEwFlFpIc KdKsLsMsMtPbPnPsRfRzTdTmWs Xc One_Half.mp.3577........[...............] 2/99 CrMt Parity_Boot.B...........[Generic 1......] 9/93 CbCsDcDgEvEwFlFpJdJrKsLsPb StPnPsRfRzSmTdTiWsXc Pieck.mp.4444.A.........[Kaczor.4444....] 6/96 CbEkJrMsMtPbTdXc QRry....................[Query, Essex...] 7/94 EvFhPn Quandary................[Parity_Boot.Enc] 3/96 AkDgKsStPsTd Quicky.1376.............[Quicksilver....] 7/96 CbFlStPnTd Quox.A..................[Stealth 2......] 7/93 CbPn Raadioga.1000...........[Nilz.1000.B....] 4/98 PsRz Ripper..................[Jack Ripper....] 3/94 AcAkCsDcEwFhFlFpIcKsMsPbSt PnPsRfRzSmTdWsXc RP.A....................[Rhubarb, PR.b..] 2/97 CrMsPs Sampo...................[Turbo, Wllop...] 1/95 AcDcEkEwFhFlJrKsMsPbStPnPs RfSbSmTdWs Spanska.1500............[...............] 7/97 PnPsRz Spanska.4250.A..........[...............] 11/97 CrDgFhFpJmPnPsRzSbTi Stealth_Boot.C..........[AMSE, NopB2....] 9/94 AkCbEkEvEwFhJdStPn Stoned.Angelina.........[...............] 5/95 CbCsDcEvFlIcJdJrMlMsPbStPn PsSmTd Stoned.Azusa.A..........[Hong Kong......] 7/93 CsPn Stoned.June_4th.A.......[Bloody!........] 7/93 CbCsIcPnSmWs Stoned.No_INT.A.........[Stoned.........] 9/94 CbCsDcEwPbStPnWs Stoned.Spirit...........[...............] 6/96 AeDcFpJrKsMsMtPbPnTdXc Stoned.Standard.B.......[New Zealand....] 3/93 CrEkEvIcPbStPnWsXc Stoned.W-Boot...........[Wonka..........] 12/93 EvStPnWs Tai-Pan.438.A...........[Whisper........] 1/95 CbDgEkFlKsMsPbStPnTdWs Tai-Pan.666.A...........[D2D............] 1/95 CbEkKsPnWs Tequila.mp.2468.A.......[...............] 7/93 CsWs TMC_Level-69............[TMC.5454.......] 2/98 MtPb TPVO.mp.3783.A..........[TVPO, 3873.....] 10/96 AdDcIcKsMlPnPsRzSbTd Tremor.4000.A...........[...............] 7/93 CbCsFlPbTdWs Unashamed.B.............[...............] 10/95 DcJrLsSt Unsnared.814............[v.814..........] 3/96 AeRz V-Sign..................[Cansu, Sigalit.] 7/93 CsKsMsPbStPnPsWs +W32/Beast.41472.A.......[(W32, W97M)....] 5/99 PsTm W32/Ska.A...............[HAPPY99........] 3/99 AkCbCrCsEkEwFpGmIcJkJmJrKb KsMlMtOzPbPnPsRvSmSoSrTiXc W95/Anxiety.1358........[Poppy..........] 11/97 DgEkFpPbPnPs W95/Anxiety.1823........[W95/Anxiety.B..] 4/98 CbDgEkFpPbPnPs W95/CIH.1003............[Spacefiller....] 8/98 AdAkCbCrCsEwFhFpIcJdJmJrKb KsLsMlMsMtOzPbPsRpRvSmSoSr TiTmXc W95/CIH.1019.A..........[.1019, CIH.C...] 7/98 CrCsEkEwFhMlMsPsSbTm W95/Fono................[W95/El_Inca.mp.] 12/98 CbFhMtPbXc +W95/K32.3030............[W95/Hazlo......] 5/99 RvSb +W95/Kenston.1895........[Kenston.1874...] 5/99 PnPsTm W95/Marburg.8590........[W95/Marburg.A..] 7/98 CbDgEwFhIcKsOzPsRpSbSm +W95/Padania.............[...............] 5/99 PsSb W97M/Appder.A...........[...............] 7/97 CbJm W97M/Brenda.A...........[...............] 1/99 FhRz W97M/Class.B............[...............] 2/99 AcCrFpKbPnPsSoTm W97M/Class.D............[...............] 12/98 AcCbCrEwFhFpGmIcJdKsMlOzPn PsRpRzSoTiXc W97M/Class.Q............[...............] 12/98 AcAdCbCrPnPsRzSoXc W97M/ColdApe.A..........[...............] 12/98 FhFpPnRvTm W97M/ColdApe.B..........[...............] 3/99 FhFpKbPs W97M/Ethan.A............[...............] 2/99 AcCbEwFpIcJdJkJmJrKbKsMtOz PnPsRvSbSmSrTiTmXc W97M/Groov.A............[...............] 7/98 DgFhJrKbPsSbSmTi W97M/Marker.C...........[...............] 4/99 EwJdJmKbKsMtOzPnPsSrTmZa +W97M/Marker.D...........[...............] 5/99 RvSmTi W97M/Melissa.A..........[Maillissa......] 4/99 AcCbCrDgEwFhFpIcJdKbKsMlMt OzPnPsRvRzSbSmTiTmXcZa W97M/Nono.A.............[Nono...........] 2/99 JkKbOzPsRpSm W97M/Nottice.A..........[...............] 4/99 JmKb +W97M/Nottice.D..........[...............] 5/99 MtXc W97M/Pri.B..............[...............] 3/99 OzPsRvSb +W97M/Proteced.A.........[...............] 5/99 OzSm W97M/Wazzu.A............[...............] 5/97 CsDgPnTd W97M/Wazzu.C............[...............] 5/97 AcDgPn WelcomB.................[Bupt...........] 6/95 CsDcEvFlIcJrKsMsPbStPnPsSb Td Win/Tentacle.10634......[Shell.10634....] 9/96 KsPnTd Win/Tentacle.1944.......[...............] 5/96 DgKsPnRzTd WM/Appder.A.............[ntthnta........] 5/97 DcDgEwKsMsOzPnPs WM/Bandung.A............[Tedious........] 12/96 DcDgPn WM/CAP.A................[...............] 5/97 AcAdAkCbCrCsDcDgEkEwFhFpIc JdJmJrKbKdKsLsMlMsMtOzPbPn PsRpRvSmSrTdTiTmXc WM/Colors.A.............[Colours........] 10/96 CbDgJdLsPnSm WM/Concept.A............[Prank Macro....] 12/96 AcAkCbCrCsDcDgEkEwFhFlIcJd JmJwJrKbKsLsMlMtOzPbStPnPs RfRvRzSbSmTdTiWs WM/CopyCap.A............[...............] 7/98 CbDgEwFhKsOzRv WM/Demon.A..............[...............] 2/99 EkJmKb WM/Divina.A.............[Infeczione.....] 12/96 CbEwLs WM/Helper.A.............[...............] 12/96 DcDgJwPn WM/Helper.B.............[...............] 7/97 CbPnXc WM/Irish.A..............[Irish..........] 10/96 CbJwPn WM/Johnny.A.............[Go Johnny......] 5/96 AkCbDgIcJdKsPn WM/Johnny.B.............[...............] 12/98 CrJm WM/Lunch.B..............[...............] 7/97 CbDcPnTd WM/MDMA.A...............[StickyKeys.....] 12/96 AcDcDgFpJwKdPnSbTdXc WM/MDMA.D...............[...............] 2/97 KsPnSbTd WM/NiceDay.A............[...............] 5/97 AeCbDcDgPnTd WM/Niknat.A.............[...............] 12/98 JmSm WM/Nottice.A............[...............] 2/99 JmSm WM/Npad.A...............[Jakarta........] 12/96 AcAkCbCsDcDgEwFhFpJdJwJrKs MsOzPbPnPsRpRvRzSbSmTdXc WM/ShowOff.A............[...............] 9/97 AcCsDcDgEwJr WM/ShowOff.C............[...............] 7/97 AcCbDcKsTd WM/Surabaya.A...........[...............] 7/97 KsPn WM/Switcher.A...........[...............] 12/97 DgEw WM/TWNO.A:Tw............[Taiwan No. 1...] 12/96 IcPn WM/TWNO.AC..............[...............] 8/98 DgFpKs WM/Wazzu.A..............[Wazzu..........] 12/96 AeCbCrDcDgEwFpIcJdJmJrKdKs MtOzPnRfRvSbSmTdWs WM/Wazzu.C..............[...............] 12/96 AcCbCsDcKbPbPnTdXc WM/Wazzu.DO.............[...............] 4/98 EwFpKsXc WM/Wazzu.F..............[Bosco..........] 2/97 CbDcKsPn WM/Wazzu.P..............[...............] 12/96 AcMsTd X97M/Extras.A...........[...............] 12/98 DgMlTm X97M/Extras.B...........[...............] 10/98 MlSbSm X97M/Laroux.A...........[...............] 7/97 CbCrDcDgEwIcJrKbKsMlMtPbRv Td X97M/Laroux.BP..........[...............] 10/98 DgKs X97M/Laroux.D...........[...............] 12/98 CrDg X97M/Laroux.DX..........[...............] 12/98 AkEwJdKbKsPnRp X97M/Laroux.E...........[...............] 12/98 CrDgKbRp +X97M/Laroux.HJ..........[Bayantel.......] 5/99 KsRpSb +X97M/Laroux.HO..........[...............] 5/99 KbKs X97M/VCX.A..............[...............] 4/99 KbRz XF/Paix.A...............[...............] 12/98 AdFpPsSm XF/Sic.A................[...............] 4/99 KbPsXc XM/Compat.A.............[...............] 12/98 EwIcSb XM/Extras.A.............[...............] 7/98 DgEwIcKbMlSmTm XM/Laroux.A.............[...............] 2/97 CrCsDcDgEkEwFhFpIcJdJmJrKb MlMsPbPnPsRaRfSmTdTm XM/Laroux.D.............[...............] 9/97 CrDgJdPbTd XM/Laroux.E.............[...............] 10/97 AcCrDcDgKbPbPnSb XM/Laroux.FC............[...............] 12/98 EwSb Yankee_Doodle.2881.A....[Yankee.2C.A....] 9/93 EkEwKsStPsSmTd ============================================================================ Total for the WildList: 151 ============================================================================ Supplemental List ============================================================================ As was noted at the start of the main list, this list is not technically part of "The WildList", as originally defined. By design, the WildList is a list of viruses verified as being in the wild by a minimum of two WildList participants. The viruses listed below do not currently meet that criteria. This additional list includes viruses reported by a single participant and are often either moving onto the main list, or dropping off of it. Please note especially that this list also tends to be more of a regional reporting mechanism. For example, a virus is often reported as very common by one regional participant, but is found nowhere else in the world. Viruses marked with a minus sign (-) dropped from the main list this month. Viruses marked with a plus sign (+) are new to the supplemental list this month. List Reported Name of Virus [ Alias(es) ] Date by: ============================================================================ Alcon...................[Ken+Desmond, RS] 3/98 Ks Ale.1911................[Sul.1911.A.....] 10/98 Rz Alfons.1344.............[Iutt99.........] 1/99 Mt BadSectors.3428.........[...............] 1/99 Cr Bap.mp.1536.............[...............] 1/99 Fh Barrotes.1310.A.........[Barrotos.......] 1/99 Fp Beah....................[...............] 2/98 Xc Bleah.C.................[...............] 3/98 Fp Bye.....................[ByeBye.........] 1/99 Ls ChaosTraveler.1200......[DMR.1200.......] 10/98 Rz Cleaner.937.............[Sopron.937.....] 3/98 Rz CLL.947.................[...............] 4/99 Ak Codbrea.431.............[Basho.431.A....] 10/98 Rz Creed.5209..............[...............] 11/98 Sb DA_Boys.A...............[...............] 1/99 Ws Dark_Avenger.1800.A.....[Eddie..........] 1/99 Ws DelCMOS.B...............[Int7F-E9, Feint] 1/99 Jm Dodgy...................[...............] 1/99 Cr Equinox.855.............[Galileo.GR.....] 11/98 Cr -EXE_Bug.C...............[...............] 9/93 Cb -Fat_Avenger.............[...............] 6/95 Kd Frodo.4096.A............[4096...........] 7/93 Ew Getto.2000..............[...............] 3/98 Rz Gimp....................[...............] 3/98 Ks Helloween.1376.A........[1376...........] 7/93 Ws HLLO.5831...............[Raid.5831......] 3/98 Sb HLLP.11712..............[...............] 10/98 Rz Istanbul.1367...........[Reu.1367, Reu.G] 3/98 Rz J&M.B...................[...............] 2/99 Mt -Jerusalem.Zero_Time.Aust[Slow...........] 7/93 Jd +Keyb.865................[...............] 5/99 Ps Kiev.1942...............[KVS.1942.......] 2/99 Ak Krueger.2271............[Freddy_Krueger.] 1/99 Ws Kuarahy.mp.4608.........[MPC3, Kua.4608.] 3/98 Rz Leandro.................[TimeWarp.......] 1/99 Ws -Little_Red.1465.A.......[Red Book, Mao..] 7/94 Ws Live_Long.791...........[...............] 10/98 Rz -Maltese_Amoeba.2365.....[Grain of Sand..] 7/93 Ws -Moloch..................[...............] 7/96 Sb Multiani................[...............] 1/99 Cr Neuroquila.mp.4544.A....[Havoc, Wedding.] 1/99 Ws Noiembrie.610...........[...............] 10/97 Rz -November_17th.855.A.....[Int83.855......] 9/93 Ls +O97M/Tristate.A.........[...............] 5/99 Sr O97M/Tristate.D.........[...............] 4/99 Pn O97M/Tristate.F.........[...............] 4/99 Jd Olk.4245................[Glew.4245......] 3/98 Rz Parity_Boot.A...........[...............] 1/99 Cb Peter...................[Peter II.......] 1/99 Cb Pojer.1919..............[Brain-1919.....] 10/97 Pb Pojer.4028..............[Brain-4028.....] 2/98 Pb Prosp.1712.A............[Opic.GR........] 7/98 Rz Stealth_Boot.B..........[AMSE, NopB.....] 1/99 Sb Swiss_Boot.A............[Swiss Army.....] 1/99 Fl SysIntended.960.........[CS.960.........] 11/98 Cr Tanpro.524..............[...............] 4/99 Ak TMC_Level-42............[TMC.????.......] 2/99 Mt Ungame.544..............[Omed.544.......] 11/98 Cr Urkel...................[Nwait..........] 1/99 Ws Vinchuca.925............[...............] 1/99 Ws VrapExe.3730............[XRF.3730, 3730.] 3/98 Fp +W2KM/Ethan.A............[...............] 5/99 Xc W32/HLLP.DeTroie.A......[W32/Cheval.TCV.] 11/98 Fp +W32/Maya................[W32/Maya.4153..] 5/99 Rv W95/CIH.1024............[...............] 3/99 Jm W95/HPS.5124............[WIN95/HPS......] 11/98 Fp W95/Lorez.1766..........[...............] 12/98 Sm +W95/Spaces.1245.........[...............] 5/99 Ps +W97M/Argh.A.............[...............] 5/99 Sb +W97M/Argh.B.............[...............] 5/99 Ps W97M/Caligula.A.........[...............] 4/99 Fp W97M/Chack.H............[...............] 2/99 Sm +W97M/Chack.I............[...............] 2/99 Ks W97M/Chack.L............[...............] 3/99 Ad W97M/Class.CN...........[...............] 4/99 Ic W97M/Class.S............[...............] 11/98 Sb W97M/Disco.D............[...............] 4/99 Kb W97M/Disco.E............[...............] 4/99 Kb +W97M/Diva...............[...............] 2/99 Ks W97M/DVD.A..............[...............] 4/99 Pn +W97M/Footer.C...........[...............] 1/99 Jr W97M/Groov.B............[...............] 8/98 Sb +W97M/IIS.I..............[...............] 5/99 Ps W97M/Kompu.H............[...............] 3/98 Ks +W97M/Marker.A...........[...............] 5/99 Sm W97M/MDMA.D.............[...............] 1/99 Jm +W97M/Opey.A.............[...............] 5/99 Rp +W97M/Opey.C.............[...............] 5/99 Rp W97M/Opey.D.............[...............] 4/99 Rp +W97M/Pri.A..............[...............] 5/99 Ps W97M/Sad.A..............[...............] 4/99 Pn W97M/Setmd.G............[...............] 3/99 Sb W97M/Shiver.C...........[...............] 3/99 Sm +W97M/Tie.T..............[...............] 5/99 Tm W97M/TWNO.AC............[...............] 11/98 Fp +W97M/Walker.1_5.........[W97M/Walker.D..] 5/99 Ps W97M/Walker.1_0.........[W97M/Sattelite.] 2/99 Sb Werewolf.1500.B.........[...............] 1/99 Sb +Win32/Semisoft.F........[...............] 5/99 Ps WM/Alien.A..............[...............] 1/99 Kd WM/Appder.B.............[...............] 1/99 Td WM/Bandung.AX...........[...............] 10/97 Rz WM/Bandung.AY...........[...............] 10/97 Rz WM/CAP.CQ...............[...............] 3/98 Rz WM/CAP.CT...............[...............] 3/98 Rz WM/CAP.DP...............[...............] 3/98 Rz WM/CAP.EG...............[...............] 3/98 Rz WM/CAP.EJ...............[...............] 3/98 Rz WM/CAP.FP...............[...............] 7/98 Rz WM/CAP.FS...............[...............] 7/98 Rz WM/CAP.GG...............[...............] 7/98 Rz WM/Cap.HB...............[...............] 10/98 Rz +WM/Concept.BB...........[...............] 5/99 Ps -WM/Concept.F............[...............] 12/96 Pn WM/Date.B...............[...............] 3/98 Ks WM/Divina.R.............[...............] 3/98 Rz WM/Dude.A...............[...............] 3/98 Rz WM/DzT.A................[...............] 2/99 Ak WM/Dzt.I................[...............] 3/98 Rz WM/Geni.A...............[...............] 8/98 Ks WM/Goldfish.A...........[...............] 1/99 Jm WM/Imposter.E...........[...............] 4/99 Kb WM/Inexist.A:Fr.........[WM/Warning.....] 2/99 Fp WM/Johnny.V.............[...............] 7/98 Rz WM/Johnny.X.............[...............] 10/98 Rz WM/KMT.A................[...............] 2/99 Sb WM/Lunch.A..............[...............] 9/97 Dc WM/MDMA.AW..............[...............] 3/98 Rz WM/Muck.AT..............[...............] 3/98 Rz WM/Muck.AV..............[...............] 3/98 Rz WM/Muck.AY..............[...............] 3/98 Rz WM/Muck.BC..............[...............] 3/98 Rz WM/Muck.BH..............[...............] 7/98 Rz WM/Muck.BJ..............[...............] 7/98 Rz WM/Muck.F...............[...............] 3/98 Dc WM/Niceday.N............[...............] 12/98 Kb WM/Niceday.U............[...............] 3/98 Rz WM/No_va.B..............[...............] 11/98 Jm WM/Npad.C...............[...............] 11/98 Cb WM/Npad.DP..............[...............] 10/97 Rz WM/Npad.FN..............[...............] 11/98 Cr WM/Npad.GJ..............[...............] 3/98 Rz WM/Npad.HA..............[...............] 3/98 Rz WM/Npad.HL..............[...............] 7/98 Rz WM/Nuclear.A............[...............] 11/98 Cr WM/Nuclear.AD...........[...............] 10/98 Rz WM/Nuclear.B............[...............] 1/99 Fl WM/Paycheck.L...........[...............] 7/98 Rz WM/Pesan.B..............[...............] 1/99 Jb WM/Rapi.A...............[...............] 1/99 Cb WM/ShowOff.CC...........[...............] 10/97 Rz WM/ShowOff.CG...........[...............] 10/97 Rz WM/Showoff.DF...........[...............] 7/98 Rz WM/Stall.A..............[...............] 11/98 Fp WM/Swlabs.B.............[...............] 10/97 Jm WM/Swlabs.G.............[...............] 1/99 Fp WM/Temple.N.............[...............] 3/98 Rz WM/Temple.Q.............[...............] 7/98 Rz WM/Temple.R.............[...............] 7/98 Rz WM/Veneno.D:Es..........[WM/Cap.GV......] 10/98 Rz WM/Wazzu.DV.............[...............] 4/98 Fp WM/Wazzu.EC.............[...............] 4/98 Fp WM/Wazzu.Q..............[...............] 9/97 Dc WM/Wazzu.X..............[...............] 2/99 Kb Worry.1472..............[Zrdavim.1472...] 3/98 Rz WPC_Bats.3199...........[WPCB.3207......] 11/98 Cr X97M/Laroux.AN..........[...............] 3/99 Ad X97M/Laroux.AU..........[...............] 6/98 Ks X97M/Laroux.CF..........[...............] 4/99 Kb X97M/Laroux.CG..........[...............] 12/98 Xc +X97M/Laroux.CN..........[Meralco........] 5/99 Rp +X97M/Laroux.CX..........[...............] 5/99 Ps X97M/Laroux.DI..........[...............] 7/98 Rz X97M/Laroux.DO..........[...............] 4/99 Kb X97M/Laroux.DW..........[...............] 11/98 Cr X97M/Laroux.EE..........[...............] 3/99 Cb +X97M/Laroux.EI..........[...............] 5/99 Mt X97M/Laroux.FC..........[...............] 3/99 Jm X97M/Laroux.GI..........[...............] 4/99 Kb X97M/Laroux.GJ..........[...............] 4/99 Kb +X97M/Laroux.GV..........[...............] 5/99 Kb X97M/Laroux.HK..........[...............] 2/99 Sb +X97M/Papa.B.............[...............] 5/99 Ps XM.Laroux.GI............[...............] 4/99 Kb XM/Extras.B.............[...............] 9/98 Ew XM/Laroux.CF............[...............] 12/98 Kb +XM/Laroux.DO............[...............] 5/99 Rv XM/Laroux.DW............[...............] 11/98 Cr XM/Laroux.DX............[...............] 4/99 Kb XM/Laroux.EO............[...............] 4/99 Jd XM/Laroux.HJ............[...............] 2/99 Sb XM/Laroux.HO............[...............] 4/99 Kb XM/UEDASAN.A............[...............] 4/99 Pn XM/UEDASAN.B............[...............] 4/99 Pn XM/UEDASAN.C............[...............] 4/99 Pn XM/VCX.A................[...............] 1/99 Sm ============================================================================ Total for both lists: 347 ============================================================================ WildList Sorted by Frequency ============================================================================ This is not a prevalence table. It does not show how common each virus is. Rather it is the WildList sorted by the number of participants that report each virus. This section gives the names, types, and aliases of the most frequently reported viruses. These viruses have been reported by at least one third of WildList participants. They are sorted with the most frequently reported first. A more complete alias list is also provided. Freq Name Type Aliases ============================================================================ 35 | WM/CAP.A................ | Macro | 34 | WM/Concept.A............ | Macro |Prank Macro 30 | AntiEXE.A............... | Boot |D3 29 | W95/CIH.1003............ | File |Spacefiller 28 | One_Half.mp.3544.A...... | Multi |Dis, Free Love 26 | Form.A.................. | Boot |Form 18 26 | WM/Npad.A............... | Macro |Jakarta 25 | AntiCMOS.A.............. | Boot |Lenart 25 | Junkie.mp.1027.A........ | Macro |DrWhite.1027 25 | W32/Ska.A............... | File |HAPPY99 25 | W97M/Melissa.A.......... | Macro |Maillissa 24 | XM/Laroux.A............. | Macro | 23 | Parity_Boot.B........... | Boot |Generic 1 23 | WM/Wazzu.A.............. | Macro |Wazzu 22 | Empire.Monkey.B......... | Boot |Monkey 2 22 | W97M/Ethan.A............ | Macro | 21 | Ripper.................. | Boot |Jack Ripper 20 | NYB.A................... | Boot |B1 19 | W97M/Class.D............ | Macro | 18 | Sampo................... | Boot |Turbo, Wllop 17 | Natas.mp.4774........... | Multi |Satan 16 | Stoned.Angelina......... | Boot | ============================================================================ Release notes for the May WildList: WildList Organization welcomes Grover Cordova of PER Antivirus. Grover is WLO's second participant to report virus incidents occurring in Peru, South America. WildList bids farewell to iRiS Software's Asaf Achitoov. Thank you for your great efforts Asaf! Officially taking Asaf's place is Taras Malivanchuk. Welcome aboard Taras. WildList Organization bids farewell to Sophos' Paul Ducklin. Paul has been a participant since the very beginning of the WildList so many years ago, first with CSIR Virus Lab and currently with Sophos. Thank you for the many years of participation Paul! Replacing Paul is Stuart Taylor. Welcome aboard Stuart. Speaking of CSIR Virus Lab, WildList Organization welcomes Joon Radley, replacement for Robert Sandilands, who stood in for Ywain Penberthy. Joon, like his predecessors, will report those virus incidents verified by CSIR Virus Lab occurring in and around South Africa. Many thanks go out to both Robert and Ywain for their constant vigilance. A small change occurs for Jakub Kaminski this month. Instead of using the identifier "Ja", Jakub will instead use Oz -- a more appropriate identifier given his reporting location! A clarification is in order for Jimmy Kuo. While in the notes section of the April 99 WildList specifically mentioned that Jimmy works for McAfee, a division of Network Associates, his information line only mentioned "Independent". Our apologies for the confusion this may have caused. In an attempt to keep people up-to-date on the continuing merger mania of the antivirus industry, there is a small change in affiliation for Klas Scholdstrom. Previously part of the company named QA, Klas now joins the Network Associates (previously and more commonly known as McAfee Associates) family. Finally, WildList Organization issues a very warm welcome to our first Coporate Reporter -- Za. WLO corporate reporters, as the category name implies, are individual participants who work for corporations not associated with the development or distribution of antivirus software. A corporate reporter name, his/her corporate affiliation, and antivirus product(s) of choice remain anonymous to the WildList. Corporate reporter identifiers will begin with the letter Z, followed by a-z (thus, all corporate reporter identifiers will appear after participant identifiers). Detailed information regarding corporate reporting will become available on May 31, 1999 at http://www.wildlist.org ************************************************************************** * REGARDING W95/CIH.1003 (mistakenly referred to as the Chernobyl virus) "Chernobyl" is a name popularized by the press. No product uses this name. The name Chernobyl is viewed as "incorrect" by all AV vendors. ============================================================================ The WildList is collated by board members of WildList Organization International. A complete archive of WildLists is available at the WildList Organization web site (http://www.wildlist.org/WildList/wildlist.html) The WildList and all material contained on this web site is the copyright of The Wildlist Organization International unless otherwise stated in the material itself. The WildList Organization International permits quotation and citation of the WildList either in whole or in part providing WildList Organization is identified as the source of the material. The WildList may not be altered or misrepresented in any way and only fair usage is permitted. Beyond these limited rights all rights are reserved. The WildList Organization International and WildList reporters make a diligent effort to ensure the accuracy of the data presented in the WildList. However, The WildList Organization makes no warranty against the accuracy of the information presented herein. The WildList Organization and WildList reporters cannot be held liable for any loss, or damages incurred from the use of WildList information. Press, print media & other queries about WildList Organization International should be sent to Sarah Ford, WildList Organization's primary media contact, at info@wildlist.org. ============================================================================ WildList Vol.905 - (c) 1993-99 Joe Wells - info@wildlist.org ============================================================================ -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.7 mQCNAy+wAnYAAAEEAO2alE3YclXZAxkqrSVXkhAuuOsx6NnVfUdKMghYtrBabFuJ +zKiIsahmjeakA2J101KZOHtKMhb5iqLG0oCbRyuBFLtuMhJrjk+L9VRCoxoDB/4 XwFevOGyxRHYfancrIydlMUooe7TZJqbGhhQEROWYm8v6RvkPFtsMpyD+Lb1AAUR tCNKb2UgV2VsbHMgPGMxandlbGxzQHdhdHNvbi5pYm0uY29tPg== =aKXf -----END PGP PUBLIC KEY BLOCK----- ============================================================================