Path: utzoo!attcan!utgpu!jarvis.csri.toronto.edu!mailrus!shadooby!samsung!cs.utexas.edu!asuvax!ncar!tank!eecae!netnews.upenn.edu!vax1.cc.lehigh.edu!sei.cmu.edu!krvw From: portal!cup.portal.com!Alan_J_Roberts@Sun.COM Newsgroups: comp.virus Subject: Known PC Virus List Message-ID: <0006.8911161700.AA03975@ge.sei.cmu.edu> Date: 15 Nov 89 20:53:57 GMT Sender: Virus Discussion List Lines: 97 Approved: krvw@sei.cmu.edu The following list was put together by John McAfee. The naming conventions follow the ViruScan conventions. Many thanks to David Chess for the concept for the list's format. VIRUS CHARACTERISTICS LIST Copyright 1989, McAfee Associates 408 988 3832 The following list outlines the critical characteristics of the known IBM PC and compatible viruses. Comments and suggestions welcomed. ==========================================================================] Infects Fixed Disk Partition Table-------------+ Infects Fixed Disk Boot Sector---------------+ | Infects Floppy Diskette Boot --------------+ | | Infects Overlay Files--------------------+ | | | Infects EXE Files----------------------+ | | | | Infects COM files--------------------+ | | | | | Infects COMMAND.COM----------------+ | | | | | | Virus Remains Resident-----------+ | | | | | | | Virus Uses Self-Encryption-----+ | | | | | | | | | | | | | | | | | | | | | | | | | | Increase in | | | | | | | | | Infected | | | | | | | | | Program's | | | | | | | | | Size | | | | | | | | | | | | | | | | | | | | Virus V V V V V V V V V V Damage - -------------------------------------------------------------------------- Do-Nothing . . . x . . . . . 608 p Sunday . x . x x x . . . 1636 O,P Lisbon . . . x . . . . . 648 P Typo/Fumble . x . x . . . . . 867 O,P Dbase . x . x . . . . . 1864 D,O,P Ghost Boot Version . x . . . . x x . N/A B,O Ghost COM Version . . . x . . . . . 2351 B,P New Jerusalem . x . x x x . . . 1808 O,P Alabama . x . . x . . . . 1560 O,P,L Yankee Doodle . x . x x . . . . 2885 O,P 2930 . x . x x . . . . 2930 P Ashar . x . . . . x . . N/A B AIDS . . . x . . . . . Overwrites Program Disk Killer . x . . . . x x . N/A B,O,P,D,F 1536/Zero Bug . x . x . . . . . 1536 O,P MIX1 . x . . x . . . . 1618 O,P Dark Avenger . x x x x x . . . 1800 O,P,L 3551/Syslock x . . x x . . . . 3551 P,D VACSINA . x . x x x . . . 1206 O,P Ohio . x . . . . x . . N/A B Typo (Boot Virus) . x . . . . x x . N/A O,B Swap/Israeli Boot . x . . . . x . . N/A B 1514/Datacrime II x . . x x . . . . 1514 P,F Icelandic II . x . . x . . . . 661 O,P Pentagon . . . . . . x . . N/A B 3066/Traceback . x . x x . . . . 3066 P 1168/Datacrime-B x . . x . . . . . 1168 P,F Icelandic . x . . x . . . . 642 O,P Saratoga . x . . x . . . . 632 O,P 405 . . . x . . . . . Overwrites Program 1704 Format x x . x . . . . . 1704 O,P,F Fu Manchu . x . x x x . . . 2086 O,P 1280/Datacrime x . . x . . . . . 1280 P,F 1701/Cascade x x . x . . . . . 1701 O,P 1704/CASCADE-B x x . x . . . . . 1704 O,P Stoned/Marijuana . x . . . . x . x N/A O,B,L 1704/CASCADE x x . x . . . . . 1704 O,P Ping Pong-B . x . . . . x x . N/A O,B Den Zuk . x . . . . x . . N/A O,B Ping Pong . x . . . . x . . N/A O,B Vienna-B . . . x . . . . . 648 P Lehigh . x x . . . . . . Overwrites P,F Vienna/648 . . . x . . . . . 648 P Jerusalem-B . x . x x x . . . 1808 O,P Yale/Alameda . x . . . . x . . N/A B Friday 13th COM Virus . . . x . . . . . 512 P Jerusalem . x . x x x . . . 1808 O,P SURIV03 . x . x x x . . . O,P SURIV02 . x . . x . . . . 1488 O,P SURIV01 . x . x . . . . . 897 O,P Pakistani Brain . x . . . . x . . N/A B Legend: Damage Fields - B - Corrupts or overwrites Boot Sector O - Affects system run-time operation P - Corrupts program or overlay files D - Corrupts data files F - Formats or erases all/part of disk L - Directly or indirectly corrupts file linkage Size Increase - The length, in bytes, by which an infected program or overlay file will increase Characteristics - x - Yes . - No