Virus
|
Alias(es)
|
Types
|
Subtype
|
Isolation date
|
Isolation
|
Origin
|
Author
|
Notes
|
1260
|
V2Px
|
DOS
|
Polymorphic[1]
|
1990
|
|
|
|
First virus family to use polymorphic encryption
|
4K
|
4096
|
DOS
|
|
1990-01
|
|
|
|
The first known MS-DOS-file-infector to use stealth
|
5lo
|
|
DOS
|
|
1992-10
|
|
|
|
Infects .EXE files only
|
Abraxas
|
Abraxas5
|
DOS, Windows 95, 98
|
[1]
|
1993-04
|
Europe
|
|
ARCV group
|
Infects COM file. Disk directory listing will be set to the system date and time when infection occurred.
|
Acid
|
Acid.670, Acid.670a, Avatar.Acid.670, Keeper.Acid.670
|
DOS, Windows 95, 98
|
|
1992
|
|
|
Corp-$MZU
|
Infects COM file. Disk directory listing will not be altered.
|
Acme
|
|
DOS, Windows 95 DOS
|
|
1992
|
|
|
|
Upon executing infected EXE, this infects another EXE in current directory by making a hidden COM file with same base name.
|
ABC
|
ABC-2378, ABC.2378, ABC.2905
|
DOS
|
|
1992-10
|
|
|
|
ABC causes keystrokes on the compromised machine to be repeated.
|
Actifed
|
|
DOS
|
|
|
|
|
|
|
Ada
|
|
DOS
|
|
1991-10
|
|
Argentina
|
|
The Ada virus mainly targets .COM files, specifically COMMAND.COM.
|
AGI-Plan
|
Month 4-6
|
DOS
|
|
|
Mülheim
|
|
|
AGI-Plan is notable for reappearing in South Africa in what appeared to be an intentional re-release.
|
AI
|
|
DOS
|
|
|
|
|
|
|
AIDS
|
AIDSB, Hahaha, Taunt
|
DOS
|
|
1990
|
|
|
|
AIDS is the first virus known to exploit the DOS "corresponding file" vulnerability.
|
AIDS II
|
|
DOS
|
|
circa 1990
|
|
|
|
|
Alabama
|
Alabama.B
|
DOS
|
|
1989-10
|
|
Hebrew University, Jerusalem
|
|
Files infected by Alabama increase in size by 1,560 bytes.
|
Alcon[1]
|
RSY, Kendesm, Ken&Desmond, Ether
|
DOS
|
|
1997-12
|
|
|
|
Overwrites random information on disk causing damage over time.
|
Ambulance
|
|
DOS
|
|
June 1990
|
|
|
|
|
Anna Kournikova
|
|
Email VBScript
|
|
2001-02-11
|
|
Sneek, Netherlands
|
Jan de Wit
|
A Dutch court stated that US$166,000 in damages was caused by the worm.
|
ANTI
|
ANTI-A, ANTI-ANGE, ANTI-B, Anti-Variant
|
Classic Mac OS
|
|
1989-02
|
France
|
|
|
The first Mac OS virus not to create additional resources; instead, it patches existing CODE resources.
|
AntiCMOS
|
|
DOS
|
|
January 1994 – 1995
|
|
|
|
Due to a bug in the virus code, the virus fails to erase CMOS information as intended.
|
ARCV-n
|
|
DOS
|
|
1992-10/1992-11
|
|
England, United Kingdom
|
ARCV Group
|
ARCV-n is a term for a large family of viruses written by the ARCV group.
|
Alureon
|
TDL-4, TDL-1, TDL-2, TDL-3, TDL-TDSS
|
Windows
|
Botnet
|
2007
|
|
Estonia
|
JD virus
|
|
Autostart
|
Autostart.A—D
|
Classic Mac OS
|
|
1998
|
Hong Kong
|
China
|
|
|
Bomber
|
CommanderBomber
|
DOS
|
|
|
|
Bulgaria
|
|
Polymorphic virus which infects systems by inserting fragments of its code randomly into executable files.
|
Brain
|
Pakistani flu
|
DOS
|
Boot sector virus
|
1986-01
|
|
Lahore, Pakistan
|
Basit and Amjad Farooq Alvi
|
Considered to be the first computer virus for the PC
|
Byte Bandit
|
|
Amiga
|
Boot sector virus
|
1988-01
|
|
|
Swiss Cracking Association
|
It was one of the most feared Amiga viruses until the infamous Lamer Exterminator.
|
CDEF
|
|
Classic Mac OS
|
|
1990.08
|
|
Ithaca, New York
|
|
Cdef arrives on a system from an infected Desktop file on removable media. It does not infect any Macintosh systems beyond OS6.
|
Christmas Tree
|
|
|
Worm
|
1987-12
|
|
Germany
|
|
|
CIH
|
Chernobyl, Spacefiller
|
Windows 95, 98, Me
|
|
1998-06
|
Taiwan
|
Taiwan
|
Chen ing-Hau
|
Activates on April 26, in which it destroys partition tables, and tries to overwrite the BIOS.
|
Commwarrior
|
|
Symbian Bluetooth worm
|
|
|
|
|
|
Famous for being the first worm to spread via MMS and Bluetooth.
|
Creeper
|
|
TENEX operating system
|
Worm
|
1971
|
|
|
Bob Thomas
|
An experimental self-replicating program which gained access via the ARPANET and copied itself to the remote system.
|
Eliza
|
|
DOS
|
|
1991-12
|
|
|
|
|
Elk Cloner
|
|
Apple II
|
|
1982
|
Mt. Lebanon, Pennsylvania
|
Mt. Lebanon, Pennsylvania
|
Rich Skrenta
|
The first virus observed "in the wild"
|
Esperanto
|
Esperanto.4733
|
DOS, MS Windows, Classic Mac OS
|
|
1997.11
|
Spain
|
Spain
|
Mister Sandman
|
First multi-processor virus. The virus is capable of infecting files on computers running Microsoft Windows and DOS on the x86 processor and MacOS, whether they are on a Motorola or PowerPC processor.
|
Fakesysdef
|
|
|
|
2010
|
|
|
|
Trojan targeting the Microsoft Windows operating system. Dispersed as an application called "HDD Defragmenter", a fake system defragmenter.
|
Form
|
|
DOS
|
|
1990
|
Switzerland
|
|
|
A very common boot virus, triggers on the 18th of any month.
|
Fun
|
|
Windows
|
|
2008
|
|
|
|
It registers itself as a Windows system process then periodically sends mail with spreading attachments as a response to any unopened emails in Outlook Express
|
Graybird
|
Backdoor.GrayBird, BackDoor-ARR
|
Windows
|
Trojan Horse
|
2003-02-04
|
|
|
|
|
Hare
|
|
DOS, Windows 95, Windows 98
|
|
1996-08
|
|
|
|
Famous for press coverage which blew its destructiveness out of proportion
|
ILOVEYOU
|
|
Microsoft
|
Worm
|
2000-05-05
|
|
Manila, Philippines
|
Michael Buen, Onel de Guzman
|
Computer worm that attacked tens of millions of Windows personal computers
|
INIT 1984
|
|
Classic Mac OS
|
|
1992-03-13
|
Ireland
|
|
|
Malicious, triggered on Friday the 13th. Init1984 works on Classic Mac OS System 6 and 7.
|
Jerusalem
|
|
DOS
|
|
1987-10
|
|
|
|
Jerusalem was initially very common and spawned a large number of variants.
|
Kama Sutra
|
Blackworm, Nyxem, and Blackmal
|
|
|
2006-01-16
|
|
|
|
Designed to destroy common files such as Microsoft Word, Excel, and PowerPoint documents.
|
Koko
|
|
DOS
|
|
1991-03
|
|
|
|
The payload of this virus activates on July 29 and February 15 and may erase data on the users hard drive
|
Lamer Exterminator
|
|
Amiga
|
Boot sector virus
|
1989-10
|
|
Germany
|
|
Random encryption, fills random sector with "LAMER"
|
MacMag
|
Drew, Bradow, Aldus, Peace
|
Classic Mac OS
|
|
1987-12
|
|
United States
|
|
Products (not necessarily the Classic Mac OS) were infected with the first actual virus.
|
MDEF
|
Garfield, Top Cat
|
Classic Mac OS
|
|
1990-05-15
|
|
Ithaca, New York
|
|
Infects menu definition resource fork files. Mdef infects all Classic Mac OS versions from 4.1 to 6.
|
Melissa
|
Mailissa, Simpsons, Kwyjibo, Kwejeebo
|
Microsoft Word macro virus
|
|
1999-03-26
|
|
New Jersey
|
David L. Smith
|
Part macro virus and part worm. Melissa, a MS Word-based macro that replicates itself through e-mail.
|
Mirai
|
|
Internet of Things
|
DDoS
|
2016
|
|
|
|
|
Michelangelo
|
|
DOS
|
|
1991-02-04
|
Australia
|
|
|
Ran March 6 (Michelangelo's birthday)
|
Mydoom
|
Novarg, Mimail, Shimgapi
|
Windows
|
Worm
|
2004-01-26
|
World
|
Russia
|
|
Mydoom was the world's fastest spreading computer worm to date, surpassing Sobig, and the ILOVEYOU computer worms, yet it was used to DDoS servers.
|
Navidad
|
|
Windows
|
Mass-mailer worm
|
2000-12
|
|
South America
|
|
|
Natas
|
Natas.4740, Natas.4744, Natas.4774, Natas.4988
|
DOS
|
Multipartite, stealth, polymorphic
|
1994.06
|
Mexico City
|
United States
|
Priest (AKA Little Loc)
|
|
nVIR
|
MODM, nCAM, nFLU, kOOL, Hpat, Jude, Mev#, nVIR.B
|
Classic Mac OS
|
|
1987-12
|
|
United States
|
|
nVIR has been known to 'hybridize' with different variants of nVIR on the same machine.
|
Oompa
|
Leap
|
Mac OSX
|
Worm
|
2006.02.10
|
|
|
|
First worm for Mac OSX. It propagates through iChat, an instant message client for Macintosh operating systems. Whether Oompa is a worm has been controversial. Some believe it is a trojan.
|
OneHalf
|
Slovak Bomber, Freelove or Explosion-II
|
DOS
|
|
1994
|
|
Slovakia
|
Vyvojar
|
It is also known as one of the first viruses to implement a technique of "patchy infection"
|
NoEscape.exe
|
|
Windows
|
|
|
|
|
Ontario.1024
|
|
|
|
|
|
|
|
|
Ontario.2048
|
|
|
|
|
|
|
|
|
Ontario
|
SBC
|
DOS
|
|
1990-07
|
|
Ontario
|
"Death Angel"
|
|
Petya
|
GoldenEye, NotPetya
|
Windows
|
Trojan horse
|
2016
|
Ukraine
|
Russia
|
|
Total damages brought about by NotPetya to more than $10 billion.
|
Pikachu virus
|
|
|
|
2000-06-28
|
|
Asia
|
|
The Pikachu virus is believed to be the first computer virus geared at children.
|
Ping-pong
|
Boot, Bouncing Ball, Bouncing Dot, Italian, Italian-A, VeraCruz
|
DOS
|
Boot sector virus
|
1988-03
|
|
Turin
|
|
Harmless to most computers
|
RavMonE.exe
|
RJump.A, Rajump, Jisx
|
Worm
|
|
2006-06-20
|
|
|
|
Once distributed in Apple iPods, but a Windows-only virus
|
SCA
|
|
Amiga
|
Boot sector virus
|
1987-11
|
|
Switzerland
|
Swiss Cracking Association
|
Puts a message on screen. Harmless except it might destroy a legitimate non-standard boot block.
|
Scores
|
Eric, Vult, NASA, San Jose Flu
|
Classic Mac OS
|
|
1988.04
|
United States
|
Fort Worth, Texas
|
Donald D. Burleson
|
Designed to attack two specific applications which were never released.
|
Scott's Valley
|
|
DOS
|
|
1990-09
|
Scotts Valley, California
|
|
|
Infected files will contain the seemingly meaningless hex string 5E8BDE909081C63200B912082E.
|
SevenDust
|
666, MDEF, 9806, Graphics Accelerator, SevenD, SevenDust.B—G
|
Classic Mac OS
|
Polymorphic
|
1989-06
|
|
|
|
Marker
|
Shankar's Virus, Marker.C, Marker.O, Marker.Q, Marker.X, Marker.AQ, Marker.BN, Marker.BO, Marker.DD, Marker.GR, W97M.Marker
|
MS Word
|
Polymorphic, Macro virus
|
1999-06-03
|
|
|
Sam Rogers
|
Infects Word Documents
|
Simile
|
Etap, MetaPHOR
|
Windows
|
Polymorphic
|
|
|
|
The Mental Driller
|
The metamorphic code accounts for around 90% of the virus' code
|
SMEG engine
|
|
DOS
|
Polymorphic
|
1994
|
|
United Kingdom
|
The Black Baron
|
Two viruses were created using the engine: Pathogen and Queeg.
|
Stoned
|
|
DOS
|
Boot sector virus
|
1987
|
Wellington
|
|
|
One of the earliest and most prevalent boot sector viruses
|
Jerusalem
|
Sunday, Jerusalem-113, Jeruspain, Suriv, Sat13, FuManchu
|
DOS
|
File virus
|
1987-10
|
Seattle
|
|
|
Virus coders created many variants of the virus, making Jerusalem one of the largest families of viruses ever created. It even includes many sub-variants and a few sub-sub-variants.
|
WannaCry
|
WannaCrypt, WannaCryptor
|
Windows
|
Ransomware Cryptoworm
|
2017
|
World
|
North Korea
|
|
|
WDEF
|
WDEF A
|
Classic Mac OS
|
|
1989.12.15
|
|
|
|
Given the unique nature of the virus, its origin is uncertain.
|
Whale
|
|
DOS
|
Polymorphic
|
1990-07-01
|
|
Hamburg
|
R Homer
|
At 9216 bytes, was for its time the largest virus ever discovered.
|
ZMist
|
ZMistfall, Zombie.Mistfall
|
Windows
|
|
2001
|
|
Russia
|
Z0mbie
|
It was the first virus to use a technique known as "code integration".
|
Xafecopy
|
|
Android
|
Trojan
|
2017
|
|
|
|
|
Zuc
|
Zuc.A., Zuc.B, Zuc.C
|
Classic Mac OS
|
|
1990.03
|
Italy
|
Italy
|
|
|