VIRUS CHARACTERISTICS LIST V76 Copyright 1989, 1990, 1991 McAfee Associates All Rights Reserved. (408) 988-3832 The following list outlines the major characteristics of the known IBM PC and compatible virus strains identified by SCAN. The number of known varients of each virus is also listed. This number is listed in parenthesis beside the name of the strain. The total number of known viruses is summed at the end of the list. The Clean-Up virus I.D. code is included in brackets. An asterisk ("*") in front of a virus name denotes an extinct computer virus. ========================================================================== A Infects Fixed Disk Partition Table-A-------------------+ 9 Infects Fixed Disk Boot Sector-----9-----------------+ | 8 Infects Floppy Diskette Boot-------8---------------+ | | 7 Infects Overlay Files--------------7-------------+ | | | 6 Infects EXE Files------------------6-----------+ | | | | 5 Infects COM files------------------5---------+ | | | | | 4 Infects COMMAND.COM----------------4-------+ | | | | | | 3 Virus Installs Self in Memory------3-----+ | | | | | | | 2 Virus Uses Self-Encryption---------2---+ | | | | | | | | 1 Virus Uses STEALTH Techniques------1-+ | | | | | | | | | | | | | | | | | | | Increase in | | | | | | | | | | Infected | | | | | | | | | | Program's | | | | | | | | | | Size 1 2 3 4 5 6 7 8 9 A | | | | | | | | | | | | Virus Disinfector V V V V V V V V V V V Damage ----------------------------------------------------------------------------- Staf [Staf] Clean-Up . . x x x . . . . . 2083 O,P,L Mix2 [MX2] Clean-Up . . x x x x x . . . 2280 O,P Brain Slayer [Slay] Clean-Up . . x . x x x . . . 5120 O,P,L,D Striker [Str] Clean-Up . . x x x . . . . . 461 O,P,F Guppy [Guppy] Clean-Up . . x x x . . . . . 152 O,P Arab Virus [Ar] Clean-Up . . x . x . . . . . 834 O,P V-801 [V801] Clean-Up . . x x x x x . . . 801 O,P,L Terror [Ter] Clean-Up . . x x x x x . . . 1085 O,P,F S-847 [S847] Clean-Up . . x . x . . . . . 850 O,P Frogs [Frogs] Clean-Up . . x x x . . . . . 1500 O,P Enigma [Enigma] Clean-Up . x x . . x x . . . 1755 O,P AGI-Plan [AGI] Clean-Up . . . x x . . . . . 1536 O,P,L Crash [Crash] Clean-Up . . . . . . . . . . (See footnote) Hymn-2 [H-2] Clean-Up . . x x x x x . . . 1962 O,P,L Tester [TV] Clean-Up . . x x x . . . . . 1000 O,P 453 [453] Clean-up . . x x x . . . . . 453 O,P Curse Boot [Curse] M-Disk . . x . . . . x x . N/A B,O Striker [STR] Clean-Up . . . . x . . . . . 461 D,O,B,L Azusa [Azusa] Clean-Up . . x . . . . x . x N/A D,O,B,L Lazy [Lazy] Clean-Up . . x x x . . . . . 720 O,P V-555 [555] Clean-Up . . x x x x x . . . 555 O,P,L Phantom [Phant] Clean-Up . . x x x . . . . . 2253 O,P V-299 [V299] Clean-Up . . . . x . . . . . 299 O,P,D Cancer [Cn] Clean-Up . . . . x . . . . . 1480 O,P,D 1575/1591 [15xx] (2) Clean-Up . . x x x x . . . . vary O,P,L USSR 492 [U492] Clean-Up . . . . x . . . . . 492 O,P USSR 1049 [U1049] Clean-Up . . x . x x . . . . 1049 O,P,L Skism [Skism] Clean-Up . . x . x x x . . . 1815 O,P Holocaust (3) [Holo] Clean-Up x . x x x . . . . . 3784 O,P,L,D Stone-90 [S90] Clean-Up . . . x x . . . . . 961 O,P 903 [903] Clean-Up . . x x x . . . . . 903 O,P Dir-Vir [DVir] Clean-Up x . x x x . . . . . 691 O,P,D Hybrid [Hybrid] Clean-Up . . . x x . . . . . 1306 O,P,L IKV528 [I528] Clean-Up . . . x x . . . . . 528 O,P Iraqi Warrior [Iwar] Clean-Up . . . x x . . . . . 777 O,P,L,D Little Pieces [LP] Clean-Up . . x . x x . . . . 1374 O,P Saddam [Saddam] Clean-Up . . x x x . . . . . 919 O,P,D,L Monxla-B [MonB] Clean-Up . . . x x . . . . . 535 O,P,L Plague [Plague] Clean-Up . . . . x x . . . . Overwriting Sentinel [Sent] Clean-Up . . x x x x x . . . 4625 L,O,P,D Swiss 143 [S143] Clean-Up . . . x x . . . . . 143 O,P,D Voronezh [Voro] Clean-Up . x x x x x x . . . 1600 O,P,D V-961 [V961] Clean-Up . . x x x . . . . . 961 O,P USSR311 [U311] Clean-Up . . . . x . . . . . 321 O,P USSR830 [U830] Clean-Up . . x x x . . . . . 830 O,P USSR529 [U529] Clean-Up . . x x x . . . . . 529 O,P USSR516 [U516] Clean-Up . . x x x . . . . . 516 O,P USSR2144 [U2144] Clean-Up . x x x x x x . . . 2144 L,O,P,D USSR1049 [U1049] Clean-Up . . x x x . . . . . 1049 O,P Tiny-133 [T133] Clean-Up . . . x x . . . . . 133 O,P Sverdlov [Sverd] Clean-Up . . x x x x x . . . 1962 O,P Label [Label] Clean-Up . . x x x . . . . . Overwrites Kukaturbo [Kuka] Clean-Up . . x x x . . . . . Overwrites Justice [Just] Clean-up . . x x x . . . . . 1242 O,P Hymn [Hymn] Clean-Up . . x x x x x . . . 642 O,P,D Happy New Year [HNew] Clean-Up . . x x x x x . . . 1865 O,P Destructor [Dest] Clean-Up . . x x x x x . . . 1150 O,P Leapfrog Virus (3) [Leap] Clean-Up . . x x x . . . . . 516 O,P,D MGTU Virus (4) [MGTU] Clean-Up . . . x x . . . . . 273 O,P,D Nina [Nina] Clean-Up . . x x x . . . . . 256 O,P,D Lozinsky (4) [Loz] Clean-Up . . . x x . . . . . 1023 O,P,D BeBe [BeBe] Clean-Up . . . x x . . . . . 1004 O,P,D Best Wish [BWish] Clean-Up . . . x x x x . . . 1024 O,P,D Beeper (2) [Beep] Clean-Up . . x . x . . . . . 482 O,P,D Parity [Parity] Clean-Up . . . x x . . . . . 441 O,P,D F-Word [FW] Clean-Up . . x x x . . . . . 417 O,P,D USSR-948 [U948] Clean-Up . x . . x x x . . . 948 O,P,D USSR-711 [U711] Clean-Up . x . . x . . . . . 711 P,D USSR-707 [U707] Clean-Up . x . x x . . . . . 707 P,D USSR-696 [U696] Clean-Up . x . . x . . . . . 696 P,D USSR-600 [U600] Clean-Up . x . x x . . . . . 600 P,D USSR-394 [U394] Clean-Up . x . x x . . . . . 394 P,D USSR-257 [U257] Clean-Up . x . x x . . . . . 257 P,D USSR-256 (2) [U256] Clean-Up . x . x x . . . . . 256 P,D Christmas Violater [CVio] Clean-Up . . . x x . . . . . ???? O,P,D Off Stealth [Off] Clean-Up x . x x x x x . . . 1689 O,P,D Jeff (3) [Jeff] Clean-Up . . . x x . . . . . 828 O,P,D,F Bloody! [Bloody] Clean-Up . x x . . . . x . x N/A B,O ZeroHunt [Hunt] Clean-Up x x x . x . . . . . N/A O,P,D Music Bug (3) [MBug] Clean-Up . . x . . . . x . x N/A B,O Dot Killer [Dot] Clean-Up . . x x x . . . . . 944 O,P Father Christmas [FC] Clean-Up . . . x x . . . . . 1881 O,P 3445 [3445] Clean-Up x x x . x x . . . . 3445 O,P,D,L Mirror (2) [Mirror] Clean-Up . . x . . x . . . . 928 O,P Polish-2 [P-2] Clean-Up . . x x x . . . . . 512 O,P,D Polish 217 [P-217] Clean-Up . . . x x . . . . . 217 O,P,D Happy Day [Happy] Clean-Up . . . x x . . . . . 453 O,P Monxla (3) [Monxla] Clean-Up . . . x x . . . . . 939 O,P USSR (4) [USSR] Clean-Up . x . . . x . . . . 575 O,P Polimer [Polimer] Clean-Up . . . x x . . . . . 512 O,P,D DataLock [Data] Clean-Up . . x x x x x . . . 920 O,P Carioca (6) [Carioca] Clean-Up . . x . x . . . . . 951 O,P 529 [529] Clean-Up . . x x x . . . . . 529 O,P,D Spyer (3) [Spyer] Clean-Up . . x . x x x . . . 1181 O,P Taiwan4 [T4] Clean-Up . . x x x x x . . . 2576 O,P,D Keypress (3) [Key] Clean-Up . . x x x x . . . . 1232 O,P,D Casper (2) [Casper] Clean-Up . x . x x . . . . . 1200 L,O,P,D 1605 (2) [1605] Clean-Up . . x x x x . . . . 1605 L,O,P,D Violator (5) [Vio] Clean-Up . . . x x . . . . . 1055 O,P,D Blood-2 [B-2] Clean-Up . . . . x . . . . . 427 O,P,D Wisconsin (3) [Wisc] Clean-Up . x . x x . . . . . 825 O,P,D Christmas-J [C-J] Clean-Up . . x x x x . . . . 600 O,P Burger (3) [Burger] Clean-Up . . . x x x . . . . Overwrites Leprosy-B [LepB] Clean-Up . . . x x x . . . . Overwrites Whale (3) [Whale] Clean-Up x x x x x x x . . . 9216 L,O,P,D Invader (4) [Invader] Clean-Up . x x . x x x x x . 4096 B,L,O,P,D Scott's Valley [SVal] Clean-Up . x x . x x x . . . 2133 L,O,P,D Black Monday (2) [BMon] Clean-Up . . x x x x x . . . 1055 L,O,P,D Nomenclature (4) [Nom] Clean-Up . . x x x x x . . . 1024 O,P,D Anthrax - Boot (2) [Atx] M-Disk . . x . . . . . . x N/A O,P,D Anthrax - File (4) [Atx] Clean-Up . . x x x x . . . . 1206 O,P,D 651 [651] Clean-Up . . x . x . . . . . 651 O,P,D Paris [Paris] Clean-Up . . . x x x x . . . 4909 O,P,D,L Leprosy (5) [Lep] Clean-Up . . x x x x x . . . Overwrites Mardi Bros. (3) [Mardi] Clean-Up . . x . . . . x x . N/A B,O 1253 - Boot [1253] M-DISK . . x . . . . x x x N/A O,P,D,L 1253 - COM [1253] Clean-Up . . x x x . . . . . 1253 O,P,D,L AirCop (3) [AirCop] Clean-Up . . x . . . . x . . N/A B,O 400 (5) [400] Clean-Up . . x . x . . . . . Vary O,P,D P1 (7) [P1r] Clean-Up . x x . x . . . . . Vary O,P,D,L Ontario [Ont] Clean-Up . x x x x x . . . . Vary O,P,D V2100 (2) [2100] Clean-Up . . x . x x . . . . 2100 O,P,D,L Plastique (9) [P1q] Clean-Up . . x x x x x . . . 3012 O,P,D Wolfman (2) [Wolf] Clean-Up . . x x x x . . . . 2064 O,P Doom2 [Dm2] Clean-Up . . x . x x . . . . 2504 O,P,D,L Flip (4) [Flip] Clean-Up . x x x x x x . . . 2343 O,P,D,L Fellowship (3) [Fellow] Clean-Up . . x . . x . . . . 1022 O,P,D,L Flash [Flash] Clean-Up . . x x x x . . . . 688 O,P,D,L 1008 [1008] Clean-Up . x x x x . . . . . 1008 O,P,D,L Taiwan3 [T3] Clean-Up . . x x x x x . . . 2905 O,P,D,L Armagedon (3) [Arma] Clean-Up . . x x x . . . . . 1079 O,P 1381 [1381] Clean-Up . . . . . x x . . . 1381 O,P Tiny (13) [Tiny] Clean-Up . . . x x . . . . . 163 O,P Subliminal (3) [Sub] Clean-Up . . x x x . . . . . 1496 O,P Sorry [Sorry] Clean-Up . . x x x . . . . . 731 O,P RedX (2) [Redx] Clean-Up . . . x x . . . . . 796 O,P 1024 (2) [1024] Clean-Up . . x x x . . . . . 1024 O,P Joshi (4) [Joshi] Clean-Up x . x . . . . x x x N/A B,O,D Microbes [Micro] M-DISK . . x . . . . x x . N/A B,O,D Print Screen (2) [PrtScr] M-DISK . . x . . . . x x . N/A B,O,D Form (2) [Form] M-DISK . . x . . . . x x . N/A B,O,D July 13th [J13] Clean-Up . x . . . x . . . . 1201 O,P,D,L 5120 (3) [5120] Clean-Up . . . x x x x . . . 5120 O,P,D,L Victor (2) [Victor] Clean-Up . . x x x x x . . . 2458 P,D,L JoJo (3) [JoJo] Clean-Up . . x . x . . . . . 1701 O,P W-13 (4) [W13] Clean-Up . . . . x . . . . . 532 O,P Slow (5) [Slow] Clean-Up . x x . x x x . . . 1721 O,P,L Frere Jacques [Frere] Clean-Up . . x . x x x . . . 1811 O,P Liberty (2) [Liberty] Clean-Up . . x x x x x . . . 2862 O,P Fish-6 (2) [Fish] Clean-Up x x x x x x x . . . 3584 O,P,L Shake [Shake] Clean-Up . . x . x . . . . . 476 O,P Murphy [Murphy] Clean-Up . . x x x x x . . . 1277 O,P V800 (3) [V800] Clean-Up x x x . x . . . . . none O,P,L Kennedy (3) [Kennedy] Clean-Up . . x . x . . . . . 308 O,P 8 Tunes/1971 (2) [1971] Clean-Up . . x . x x x . . . 1971 O,P Yankee - 2 [Doodle2] Clean-Up . . . . x x . . . . 1961 O,P June 16th [June16] Clean-Up . . . x x . . . . . 1726 F,O,P,L XA1 [XA1] Clean-Up . x . . x . . . . . 1539 F,O,P,L 1392 [1392] Clean-Up . . x x x x . . . . 1392 O,P,L 1210 [1210] Clean-Up . . x . x . . . . . 1210 O,P,L 1720 (3) [1720] Clean-Up . . x . x x x . . . 1720 F,O,P,L Saturday 14th (3) [Sat14] Clean-Up . . x . x x x . . . 685 F,O,P,L Korea (4) [Korea] Clean-Up . . . . . . . x x . N/A B,O Vcomm (5) [Vcomm] Clean-Up . . . . . x . . . . 1074 O,P,L ItaVir [Ita] Clean-Up . . . . . x . . . . 3880 O,P,L,B Solano (3) [Solano] Clean-Up . . x . x . . . . . 2000 O,P,L V2000 (3) [2000] Clean-Up . . x x x x x . . . 2000 O,P,L 1559 [1559] Clean-Up . . x x x x . . . . 1554 O,P,L 512 (5) [512] Clean-Up x . x x x . . . . . none O,P,L EDV (2) [EDV] Clean-Up x . x . . . . x x x N/A B,O Joker [Joke] Clean-Up . . x x x . . . . . O,P Icelandic-3 [Ice-3] Clean-Up . . x . . x . . . . 853 O,P Virus-101 [101] Clean-Up . x x x x x x x . . 2560 P 1260 (3) [1260] Clean-Up . x . . x . . . . . 1260 P Perfume (2) [Fume] Clean-Up . . . . x . . . . . 765 P Taiwan (3) [Taiwan] Clean-Up . . . . x . . . . . 708 P Chaos [Chaos] MDISK . . x . . . . x x . N/A B,O,D,F Virus-90 [90] Clean-Up . . x . x . . . . . 857 P Oropax (5) [Oro] Clean-Up . . x . x . . . . . 2773 P,O 4096 (4) [4096] Clean-Up x . x x x x x . . . 4096 D,O,P,L Devil's Dance (2) [Dance] Clean-Up . . x . x . . . . . 941 D,O,P,L Amstrad (5) [Amst] Clean-Up . . . . x . . . . . 847 P Payday (2) [Payday] Clean-Up . . x . x x x . . . 1808 P Datacrime II-B [Crime-2] Clean-Up . x . x x x . . . . 1917 P,F Sylvia/Holland [Holland] Clean-Up . . . . x . . . . . 1332 P Do-Nothing [Nothing] Clean-Up . . x . x . . . . . 608 P Sunday (4) [Sunday] Clean-Up . . x . x x x . . . 1636 O,P Lisbon (2) [Lisb] Clean-Up . . . . x . . . . . 648 P Typo/Fumble [Typo] Clean-Up . . x . x . . . . . 867 O,P Dbase [Dbase] Clean-Up . . x . x . . . . . 1864 D,O,P Ghost Boot [Ghost] Clean-Up . . x . . . . x x . N/A B,O Ghost COM [Ghost] Clean-Up . . . . x . . . . . 2351 B,P Alabama (3) [Alabama] Clean-Up . . x . . x . . . . 1560 O,P,L Yankee Doodle (6) [Doodle] Clean-Up . . x . x x . . . . 2885 O,P 2930 [2930] Clean-Up . . x . x x . . . . 2930 P AIDS (4) [Aids] Clean-Up . . . . x . . . . . Overwrites Disk Killer (4) [Killer] Clean-Up . . x . . . . x x . N/A B,O,P,D,F 1536/Zero Bug [Zero] Clean-Up . . x . x . . . . . 1536 O,P MIX1 [Ice] Clean-Up . . x . . x . . . . 1618 O,P Dark Avenger (4) [Dav] Clean-Up . . x x x x x . . . 1800 O,P,L 3551/Syslock [Syslock] Clean-Up . x . . x x . . . . 3551 P,D VACSINA (5) [Vacs] Clean-Up . . x . x x x . . . 1206 O,P Typo Boot [TBoot] Clean-Up . . x . . . . x x . N/A O,B Swap Boot [Swap] M-DISK . . x . . . . x . . N/A B Datacrime II [Crime-2] Clean-Up . x . . x x . . . . 1514 P,F Icelandic II [Ice-2] Clean-Up . . x . . x . . . . 661 O,P Pentagon [Pentagon] M-DISK . . . . . . . x . . N/A B Traceback (3) [3066] Clean-Up . . x . x x . . . . 3066 P Datacrime-B [Crime-B] Clean-Up . x . . x . . . . . 1168 P,F Icelandic (3) [Ice] Clean-Up . . x . . x . . . . 642 O,P 405 [405] Clean-Up . . . . x . . . . . Overwrites Fu Manchu (4) [Fu] Clean-Up . . x . x x x . . . 2086 O,P Datacrime (2) [Crime] Clean-Up . x . . x . . . . . 1280 P,F 1701/Cascade (12) [170x] Clean-Up . x x . x . . . . . 1701 O,P Stoned (8) [Stoned] Clean-Up . . x . . . . x . x N/A O,B,L Ping Pong-B (7) [Ping] Clean-Up . . x . . . . x x . N/A O,B Den Zuk (4) [DenZuk] Clean-Up . . x . . . . x . . N/A O,B Lehigh [Lehigh] Clean-Up . . x x . . . . . . Overwrites P,F Vienna/648 (19) [Vienna] Clean-Up . . . . x . . . . . 648 P Alameda (2) [Alameda] Clean-Up . . x . . . . x . . N/A B Friday 13th COM [Fri13] Clean-Up . . . . x . . . . . 512 P Jerusalem (24) [Jeru] Clean-Up . . x . x x x . . . 1808 O,P SURIV02 [SurivA] Clean-Up . . x . . x . . . . 1488 O,P SURIV01 [SurivA] Clean-Up . . x . x . . . . . 897 O,P Brain (4) [Brain] Clean-Up . . x . . . . x . . N/A B Total Known Viruses - 501 LEGEND: Size Increase: N/A - Virus does not attach to files. None - Virus does not change file size (attaches to tag end of file) Overwrites - Virus overwrites beginning of file, no file size change All Others - The length in bytes by which a file will increase when infected. Damage Fields: B - Corrupts or overwrites the boot sector D - Corrupts data files F - Formats or overwrites all/part of disk L - Directly or indirectly corrupts file linkage O - Affects system run-time operation P - Corrupts program or overlay files Characteristics: x - Yes . - No Disinfectors: CLEAN-UP - CLEAN-UP universal virus disinfector SCAN /D - VIRUSCAN with /D option SCAN /D /A - VIRUSCAN with /D and /A options MDISK /P - MDISK with "P" option All Others - The name of disinfecting program NOTE: The SCAN /D options will overwrite and then delete the entire infected program. The program must then be replaced from the original program diskette. If you wish to try and recover an infected program, then use the above-named disinfector if available. If a virus infects Overlay Files (Item 7) Clean-Up should be used with the /A option when removing the virus. Footnote: The 'crash' virus (in all implementations we have encountered) crashes when run. It is included since it is possible that under other architectures than those tested, it might flourish.