Editing Comparison of computer viruses (section)

== Comparison of viruses and related programs ==
<!-- In each table, for each term, link one instance only, usually the 1st, remove other WP:OVERLINK(s). -->{|class="wikitable sortable" border="1"
!Virus
!Alias(es)
!Types
!Subtype
!Isolation date
!Isolation
!Origin 
!Author 
!Notes
|-
|[[1260 (computer virus)|1260]]
|V2Px
|[[DOS]]
|[[polymorphic code|Polymorphic]]<ref name="AAA" />
|1990
|
|
|
|First virus family to use polymorphic encryption
|-
|[[4K (computer virus)|4K]]
|4096 
|DOS
|
|1990-01
|
|
|
|The first known MS-DOS-file-infector to use stealth
|-
|[[5lo]]
|
|DOS
|
|1992-10
|
|
|
|Infects .EXE files only
|-
|[[Abraxas (computer virus)|Abraxas]]
|Abraxas5
|DOS,<br>Windows 95, 98
|<ref name="AAA" />
|1993-04
|[[Europe]]
|
|ARCV group
|Infects [[COM file]]. Disk directory listing will be set to the system date and time when infection occurred.
|-
|[[Acid (computer virus)|Acid]]
|Acid.670, Acid.670a, Avatar.Acid.670, Keeper.Acid.670
|DOS,<br>Windows 95, 98
|
|1992
|
|
|Corp-$MZU
|Infects [[COM file]]. Disk directory listing will not be altered.
|-
|[[Acme (computer virus)|Acme]]
|
|DOS,<br>Windows 95 DOS
|
|1992
|
|
|
|Upon executing infected [[EXE]], this infects another EXE in current directory by making a hidden [[COM file]] with same base name.
|-
|[[ABC (computer virus)|ABC]]
|ABC-2378, ABC.2378, ABC.2905
|DOS
|
|1992-10
|
|
|
|ABC causes keystrokes on the compromised machine to be repeated.
|- 
|[[Actifed (computer virus)|Actifed]]
|
|DOS
|
|
|
|
|
|
|- 
|[[Ada (computer virus)|Ada]]
|
|DOS
|
|1991-10
|
|[[Argentina]]
|
|The Ada virus mainly targets .COM files, specifically COMMAND.COM.
|- 
|[[AGI-Plan]]
|Month 4-6
|DOS
|
|
|[[Mülheim]]
|
|
|AGI-Plan is notable for reappearing in South Africa in what appeared to be an intentional re-release.
|- 
|AI
|
|DOS
|
|
|
|
|
|
|- 
|[[AIDS (computer virus)|AIDS]]
|AIDSB, Hahaha, Taunt
|DOS
|
|1990
|
|
|
|AIDS is the first virus known to exploit the DOS "corresponding file" vulnerability.
|- 
|[[AIDS II (computer virus)|AIDS II]]
|
|DOS
|
|circa 1990
|
|
|
|
|-
|[[Alabama (computer virus)|Alabama]]
|Alabama.B 
|DOS
|
|1989-10
|
|[[Hebrew University]], Jerusalem
|
|Files infected by Alabama increase in size by 1,560 bytes.
|-
|[[Alcon (computer virus)|Alcon]]<ref name=AAA>{{cite news|url=http://www.spywareloop.com/news/computer-viruses|title=Computer Viruses in SpyWareLoop.com|author=Vincentas|newspaper=Spyware Loop|date=11 July 2013|access-date=28 July 2013|archive-date=21 September 2013|archive-url=https://web.archive.org/web/20130921054427/http://www.spywareloop.com/news/computer-viruses|url-status=dead}}</ref>
|RSY, Kendesm, Ken&Desmond, Ether
|DOS
|
|1997-12
|
|
|
|Overwrites random information on disk causing damage over time.
|-
|[[Ambulance (computer virus)|Ambulance]]
|
|DOS
|
|June 1990
|
|
|
|
|-
|[[Anna Kournikova (computer virus)|Anna Kournikova]]
|
|[[Email]]<br/>[[VBScript]]
|
|2001-02-11
|
|[[Sneek]], Netherlands
|Jan de Wit
|A Dutch court stated that US$166,000 in damages was caused by the worm.
|-
|[[ANTI (computer virus)|ANTI]]
|ANTI-A, ANTI-ANGE, ANTI-B, Anti-Variant
|Classic Mac OS
|
|1989-02
|[[France]]
|
|
|The first Mac OS virus not to create additional resources; instead, it patches existing CODE resources.
|-
|[[AntiCMOS (computer virus)|AntiCMOS]]
|
|DOS
|
|January 1994 – 1995
|
|
|
|Due to a [[Software bug|bug]] in the virus code, the virus fails to erase [[CMOS]] information as intended.
|-
|[[ARCV-n (computer virus)|ARCV-n]]
|
|DOS
|
|1992-10/1992-11
|
|[[England]], United Kingdom
|ARCV Group
|ARCV-n is a term for a large family of viruses written by the ARCV group.
|-
|Alureon
|[[TDL-4]], TDL-1, TDL-2, TDL-3, TDL-TDSS
|Windows
|[[Botnet]]
|2007
|
|[[Estonia]]
|JD virus
|
|-
|Autostart
|Autostart.A—D
|Classic Mac OS
|
|1998
|[[Hong Kong]]
|[[China]]
|
|
|-
|[[Bonzi Buddy (computer virus) | Bonzi Buddy]]
|[[Bomber (computer virus)|Bomber]], CommanderBomber
|DOS
|
|
|
|[[Bulgaria]]
|
|Polymorphic virus which infects systems by inserting fragments of its code randomly into executable files.
|-
|[[Brain (computer virus)|Brain]]
|[[Pakistani flu]]
|DOS
|Boot sector virus
|1986-01
|
|[[Lahore]], [[Pakistan]]
|[[Basit Farooq Alvi|Basit]] and [[Amjad Farooq Alvi]]
|Considered to be the first [[computer virus]] for the [[Personal computer|PC]]
|- 
|[[Byte Bandit]]
|
|Amiga
|Boot sector virus
|1988-01
|
|
|[[Swiss Cracking Association]]
|It was one of the most feared Amiga viruses until the infamous Lamer Exterminator.
|-
|CDEF
|
|Classic Mac OS
|
|1990.08
|
|[[Ithaca, New York]]
|
|Cdef arrives on a system from an infected Desktop file on removable media. It does not infect any Macintosh systems beyond OS6.
|-
|[[Christmas Tree (computer virus)|Christmas Tree]]
|
|
|Worm
|1987-12
|
|[[Germany]]
|
|
|-
|[[CIH (computer virus)|CIH]]
|[[Chernobyl Nuclear Power Plant|Chernobyl]], Spacefiller
|[[Microsoft Windows|Windows 95, 98, Me]]
|
|1998-06
|[[Taiwan]]
|[[Taiwan]]
|Chen ing-Hau
|Activates on April 26, in which it destroys partition tables, and tries to overwrite the [[BIOS]].
|-
|[[Commwarrior (computer virus)|Commwarrior]]
|
|[[Symbian]] [[Bluetooth]] worm
|
|
|
|
|
|Famous for being the first worm to spread via [[Multimedia Messaging Service|MMS]] and Bluetooth.
|- 
|[[Creeper (program)|Creeper]]
|
|[[TENEX (operating system)|TENEX operating system]]
|Worm
|1971
|
|
|Bob Thomas
|An experimental self-replicating program which gained access via the ARPANET and copied itself to the remote system.
|-
|[[Eliza (computer virus)|Eliza]]
|
|DOS
|
|1991-12
|
|
|
|
|- 
|[[Elk Cloner]]
|
|[[Apple II]]
|
|1982
|[[Mt. Lebanon, Pennsylvania]]
|Mt. Lebanon, Pennsylvania
|Rich Skrenta
|The first virus observed "in the wild"
|-
|[[Esperanto (computer virus)|Esperanto]]
|Esperanto.4733
|DOS, MS Windows, Classic Mac OS
|
|1997.11
|[[Spain]]
|[[Spain]]
|Mister Sandman
|First multi-processor virus. The virus is capable of infecting files on computers running Microsoft Windows and DOS on the x86 processor and MacOS, whether they are on a Motorola or PowerPC processor.
|-
|Fakesysdef
|
|
|
|2010
|
|
|
|[[Trojan horse (computing)|Trojan]] targeting the [[Microsoft Windows]] [[operating system]].  Dispersed as an application called "HDD Defragmenter", a '''fa'''ke '''sys'''tem '''def'''ragmenter.
|-
|[[Form (computer virus)|Form]]
|
|DOS
|
|1990
|[[Switzerland]]
|
|
|A very common boot virus, triggers on the 18th of any month.
|-
|[[Fun.exe virus|Fun]]
|
|Windows
|
|2008
|
|
|
| It registers itself as a Windows system process then periodically sends mail with spreading attachments as a response to any unopened emails in Outlook Express
|-
|[[Graybird]]
|Backdoor.GrayBird, BackDoor-ARR
|Windows
|Trojan Horse
|2003-02-04
|
|
|
|
|- 
|[[Hare (computer virus)|Hare]]
|
|DOS,<br>[[Windows 95]], [[Windows 98]]
|
|1996-08
|
|
|
|Famous for press coverage which blew its destructiveness out of proportion
|-
|[[ILOVEYOU]]
|
|Microsoft
|Worm
|2000-05-05
|
|[[Manila]], [[Philippines]]
|Michael Buen, Onel de Guzman
|Computer worm that attacked tens of millions of Windows personal computers
|-
|[[INIT 1984 (computer virus)|INIT 1984]]
|
|Classic Mac OS
|
|1992-03-13
|[[Ireland]]
|
|
|Malicious, triggered on Friday the 13th.  Init1984 works on Classic Mac OS System 6 and 7.

|-
|[[Jerusalem (computer virus)|Jerusalem]]
|
|DOS
|
|1987-10
|
|
|
|Jerusalem was initially very common and spawned a large number of variants.
|-
|[[Kama Sutra (computer worm)|Kama Sutra]]
|Blackworm, Nyxem, and Blackmal
|
|
|2006-01-16
|
|
|
|Designed to destroy common files such as Microsoft Word, Excel, and PowerPoint documents.
|-
|[[KoKo (computer virus)|Koko]]
|
|DOS
|
|1991-03
|
|
|
|The payload of this virus activates on July 29 and February 15 and may erase data on the users hard drive
|-
|[[Lamer Exterminator (computer virus)|Lamer Exterminator]]
|
|Amiga
|Boot sector virus
|1989-10
|
|[[Germany]]
|
|Random encryption, fills random sector with "LAMER"
|-
|[[MacMag]]
|Drew, Bradow, Aldus, Peace
|Classic Mac OS
|
|1987-12
|
|[[United States]]
|
|Products (not necessarily the Classic Mac OS) were infected with the first actual virus.
|-
|[[MDEF (computer virus)|MDEF]]
|Garfield, Top Cat
|Classic Mac OS
|
|1990-05-15<br />
|
|[[Ithaca, New York]]
|
|Infects menu definition resource fork files. Mdef infects all Classic Mac OS versions from 4.1 to 6.
|-
|[[Melissa (computer virus)|Melissa]]
|Mailissa, Simpsons, Kwyjibo, Kwejeebo
|[[Microsoft Word]] macro virus
|
|1999-03-26
|
|[[New Jersey]]
|David L. Smith
|Part macro virus and part worm. Melissa, a MS Word-based macro that replicates itself through e-mail.
|-
|Mirai
|
|Internet of Things
|DDoS
|2016
|
|
|
|
|-
|[[Michelangelo (computer virus)|Michelangelo]]
|
|DOS
|
|1991-02-04
|[[Australia]]
|
|
|Ran March 6 ([[Michelangelo]]'s birthday)

|-
|[[Mydoom]]
|Novarg, Mimail, Shimgapi
|Windows
|Worm
|2004-01-26
|World
|[[Russia]]
|
|Mydoom was the world's fastest spreading computer worm to date, surpassing [[Sobig]], and the [[ILOVEYOU]] computer worms, yet it was used to DDoS servers.
|-
||[[Navidad virus|Navidad]]
|
|Windows
|Mass-mailer worm
|2000-12
|
|[[South America]]
|
|
|-
|[[Natas (computer virus)|Natas]]
|Natas.4740, Natas.4744, Natas.4774, Natas.4988
|DOS
|Multipartite, stealth, polymorphic
|1994.06
|[[Mexico City]]
|[[United States]]
|Priest (AKA Little Loc)
|
|-
|[[nVIR (computer virus)|nVIR]]
|MODM, nCAM, nFLU, kOOL, Hpat, Jude, Mev#, nVIR.B
|Classic Mac OS
|
|1987-12
|
|[[United States]]
|
|nVIR has been known to 'hybridize' with different variants of nVIR on the same machine.
|-
|Oompa
|Leap
|Mac OSX
|Worm
|2006.02.10
|
|
|
|First worm for Mac OSX. It propagates through iChat, an instant message client for Macintosh operating systems. Whether Oompa is a worm has been controversial. Some believe it is a trojan.
|-
|[[OneHalf (computer virus)|OneHalf]]
|Slovak Bomber, Freelove or Explosion-II
|DOS
|
|1994
|
|[[Slovakia]]
|Vyvojar
|It is also known as one of the first viruses to implement a technique of "patchy infection"
|- 
|NoEscape.exe
|
|Windows
|
|
|
|
|
|
|-
|[[Ontario.1024 (computer virus)|Ontario.1024]]
|
|
|
|
|
|
|
|
|-
|[[Ontario.2048 (computer virus)|Ontario.2048]]
|
|
|
|
|
|
|
|
|- 
|[[Ontario (computer virus)|Ontario]]
|SBC
|DOS
|
|1990-07
|
|[[Ontario]]
|"Death Angel"
|
|-
|[[Petya (malware)|Petya]]
|GoldenEye, NotPetya
|Windows
|Trojan horse
|2016
|[[Ukraine]]
|[[Russia]]
|
|Total damages brought about by NotPetya to more than $10 billion.
|-
|[[Pikachu virus]]
|
|
|
|2000-06-28
|
|[[Asia]]
|
|The Pikachu virus is believed to be the first computer virus geared at children.
|- 
|[[Ping-pong virus|Ping-pong]]
| Boot, Bouncing Ball, Bouncing Dot, Italian, Italian-A, VeraCruz
| DOS
|Boot sector virus
|1988-03
|
|[[Turin]]
|
| Harmless to most computers
|-
|[[RavMonE.exe]]
|RJump.A, Rajump, Jisx
|Worm
|
|2006-06-20
|
|
|
|Once distributed in [[iPod|Apple iPods]], but a Windows-only virus
|-
|[[SCA (computer virus)|SCA]]
|
|Amiga
|Boot sector virus
|1987-11
|
|[[Switzerland]]
|[[Swiss Cracking Association]]
|Puts a message on screen.  Harmless except it might destroy a legitimate non-standard boot block.
|-
|[[Scores (computer virus)|Scores]]
|Eric, Vult, NASA, San Jose Flu
|[[Classic Mac OS]]
|
|1988.04
|[[United States]]
|[[Fort Worth, Texas]]
|Donald D. Burleson
|Designed to attack two specific applications which were never released.
|- 
|[[Scott's Valley (computer virus)|Scott's Valley]]
|
|DOS
|
|1990-09
|[[Scotts Valley, California]]
|
|
|Infected files will contain the seemingly meaningless hex string 5E8BDE909081C63200B912082E.
|-
|[[SevenDust (computer virus)|SevenDust]]
|666, MDEF, 9806, Graphics Accelerator, SevenD, SevenDust.B—G
|Classic Mac OS
|Polymorphic
|1989-06
|
|
|
|
|-
|Marker
|Shankar's Virus, Marker.C, Marker.O, Marker.Q, Marker.X, Marker.AQ, Marker.BN, Marker.BO, Marker.DD, Marker.GR, W97M.Marker
|MS Word
|Polymorphic, Macro virus
|1999-06-03
|
|
|Sam Rogers
|Infects Word Documents
|-
|[[Simile (computer virus)|Simile]]
|Etap, MetaPHOR
|Windows
|Polymorphic
|
|
|
|The Mental Driller
|The metamorphic code accounts for around 90% of the virus' code
|-
|[[Smeg Virus Construction Kit|SMEG engine]]
|
|DOS
|Polymorphic
|1994
|
|[[United Kingdom]]
|The Black Baron
|Two viruses were created using the engine: Pathogen and Queeg.
|-
|[[Stoned (computer virus)|Stoned]]
|
|DOS
|Boot sector virus
|1987
|[[Wellington]]
|
|
|One of the earliest and most prevalent boot sector viruses
|-
|[[Jerusalem (computer virus)|Jerusalem]]
|[[Sunday (computer virus)|Sunday]], Jerusalem-113, Jeruspain, Suriv, Sat13, FuManchu
|DOS
|File virus
|1987-10
|[[Seattle]]
|
|
|Virus coders created many variants of the virus, making Jerusalem one of the largest families of viruses ever created. It even includes many sub-variants and a few sub-sub-variants. 
|-
|[[WannaCry]]
|WannaCrypt, WannaCryptor
|Windows
|Ransomware Cryptoworm
|2017
|World
|[[North Korea]]
|
|
|-
|WDEF
|WDEF A
|Classic Mac OS
|
|1989.12.15
|
|
|
|Given the unique nature of the virus, its origin is uncertain.
|-
|[[Whale (computer virus)|Whale]]
|
|DOS
|Polymorphic
|1990-07-01
|
|[[Hamburg]]
|R Homer
|At 9216 bytes, was for its time the largest virus ever discovered.
|-
|[[ZMist (computer virus)|ZMist]]
|ZMistfall, Zombie{{Not a typo|.}}Mistfall
|Windows
|
|2001
|
|[[Russia]]
|Z0mbie
|It was the first virus to use a technique known as "code integration".
|-
|[[Xafecopy Trojan|Xafecopy]]
|
|Android
|Trojan
|2017
|
|
|
|
|-
|Zuc
|Zuc.A., Zuc.B, Zuc.C
|Classic Mac OS
|
|1990.03
|[[Italy]]
|[[Italy]]
|
|
|-
|}

=== Related lists ===
*[[List of computer worms]]
*[[Timeline of computer viruses and worms]]

==== Unusual subtypes ====
*[[Palm OS viruses]]
*[[HyperCard viruses]]
*[[Linux malware]]

==== Notable instances ====
*[[Conficker]]
*[[Creeper virus]] - The first malware that ran on ARPANET
*[[ILOVEYOU]]
*[[Leap (computer worm)|Leap]] - Mac OS X Trojan horse
*[[Shamoon]] a wiper virus with stolen digital certificates destroyed over 35,000 computers owned by [[Saudi Aramco]].
*[[Storm Worm]] - A Windows trojan horse that forms the [[Storm botnet]]
*[[Stuxnet]] First destructive [[Industrial control system|ICS]]-targeting [[Trojan horse (computing)|Trojan]] which destroyed part of [[Iran]]'s nuclear program. The virus destroyed the centrifuge components making it impossible to enrich [[uranium]] to weapons grade.

==== Similar software ====
*[[Adware]]
*[[Malware]]
*[[Spamming]]
*[[Spyware]]
*[[Computer worm]]
*[[Trojan horse (computing)|Trojan horse]]

=== Security topics ===
*[[Antivirus software]]
*[[Computer insecurity]]
*[[Cryptovirology]]
*[[Security through obscurity]]
*[[Cyberwarfare]]