| Name |
Alias(es) |
Type |
Subtype |
Isolation Date |
Isolation |
Origin |
Author |
Notes |
| Badtrans |
|
|
Mass mailer |
November 24, 2001 |
|
|
|
Installed a keylogger; distributed logged information |
| Bagle |
Beagle, Mitglieder, Lodeight |
|
|
January 18, 2004 |
Mass mailer |
|
|
|
| Blaster |
Lovesan |
|
|
August 11, 2003 |
Gruel.exe Makes all exe's unusable so the computer probably can't reboot |
Hopkins, Minnesota |
Jeffrey Lee Parson |
Targeted toward Bill Gates; contained message "billy gates why do you make this possible ? Stop making money and fix your software!!" |
| Brontok |
W32/Rontokbro.gen@MM, W32.Rontokbro@mm, BackDoor.Generic.1138, W32/Korbo-B, Worm/Brontok.a, Win32.Brontok.A@mm, Worm.Mytob.GH, W32/Brontok.C.worm, and Win32/Brontok.E, W32.Rontokbro.D@mm. |
|
|
October 3, 2005 |
|
Indonesia |
|
Spread through an Indonesian e-mail headed with "stop the collapse in this country"; destroys firewalls |
| BuluBebek |
W32/VBWorm.QXE |
|
|
October 10, 2008 |
|
|
|
|
| Code Red |
ndjupi |
Server Jamming Worm |
|
July 13, 2001 |
|
|
|
Defaced websites with "Hacked by Chinese!" |
| Daprosy Worm |
Worm.Win32.VB.arz, W32.Autorun.worm.h, W32/Autorun-AMS, Worm:Win32/Autorun.UD |
Trojan worm |
Mass mailer |
July 15, 2009 |
|
|
|
Replaces folders with .EXE's, key logger, slow mass mailer |
| Code Red II |
|
|
|
August 4, 2001 |
|
|
|
Exploited Microsoft Internet Information Server security holes. |
| Dabber |
W32/Dabber-C, W32/Dabber.A |
|
|
May 14, 2004 |
|
|
|
|
| Doomjuice |
|
|
|
Feb 11, 2004 |
|
|
|
Attacked computers that had previously been infected by the Mydoom worm. |
| ExploreZip |
I-Worm.ZippedFiles |
|
|
June 6, 1999 |
|
|
|
Spread through zipped documents in a spam e-mail. |
| Father Christmas |
HI.COM |
|
|
December 1988 |
|
|
|
|
| Hybris |
Snow White, Full Moon, Vecna.22528 |
|
|
December 11, 2000 |
|
Brazil |
Vecna |
Spread through an e-mail from "haha@sexyfun.net" |
| ILOVEYOU |
Loveletter, LoveBug |
|
|
May 4, 2000 |
|
Manila, Philippines |
| Kaja |
Parasite |
|
|
|
|
|
|
|
|
| Kak worm |
|
|
|
October 22, 1999 |
|
|
|
Restarted the computer after 5pm, on the first day of each month, and displayed the message: "Driver Memory Error - Kagou-Anti-Kro$oft says not today !" |
| Klez |
|
|
|
October 2001 |
|
|
|
|
| Koobface |
|
|
|
December 2008 |
|
|
|
Targeted MySpace and Facebook users with a heading of "Happy Holidays" |
| Mabutu |
|
|
|
July 27, 2004 |
|
|
|
|
| Melissa |
Simpsons, Kwyjibo, Kwejeebo |
|
|
March 26, 1999 |
|
|
|
Not originally intended as harmful, but crashed servers by flooding them with e-mail |
| Morris |
|
|
|
November 2, 1988 |
|
|
Robert Tappan Morris |
The first computer worm, written to gauge the size of the Internet. It unintentionally slowed and crashed computers. |
| Mydoom |
W32.MyDoom@mm, Novarg, Mimail.R, Shimgapi |
|
|
January 26, 2004 |
|
|
|
Fastest-spreading e-mail worm known; used to attack SCO Group. |
| Mylife |
W32.MyLife.C@mm |
|
|
April 2, 2002 |
|
|
|
[1] |
| Navidad |
|
|
|
|
|
|
|
|
| Netsky |
|
|
|
February 18, 2004 |
|
Germany |
Sven Jaschan |
|
| Nimda |
|
|
|
September 2001 |
|
|
|
Originally suspected to be connected to Al Qaeda because of release date; uses multiple infection vectors |
| Sadmind |
|
|
|
May 8, 2001 |
|
|
|
|
| Sasser |
Big One |
|
|
April 30, 2004 |
|
|
Sven Jaschan |
|
| Sircam |
|
|
|
|
|
|
|
Spread through e-mail with text like "I send you this file in order to have your advice." |
| Sober |
CME-681, WORM_SOBER.AG |
|
|
October 24, 2003 |
|
Germany, possibly from National Democratic Party of Germany |
|
Was disguised as e-mail from United States government. |
| Sobig |
|
|
|
|
|
|
|
|
| SQL Slammer |
DDOS.SQLP1434.A, the Sapphire Worm, SQL_HEL, W32/SQLSlammer |
|
|
|
|
|
|
Caused global Internet slowdown |
| Stuxnet |
Win32/Stuxnet |
|
|
June 2010 |
|
|
|
First malware to attack SCADA systems. |
| Swen |
|
|
|
|
|
|
|
|
| Supernova Worm |
Supova, Hello Kitty |
|
|
July 10, 2002 |
|
|
|
Posed as files relating to video games Quake and Grand Theft Auto; attacked Christian websites |
| Upering |
Annoyer.B, Sany |
|
|
July 22, 2003 |
|
|
|
|
| W32/Bolgimo.worm |
|
|
|
|
|
|
|
|
| W32/Fus.worm |
|
|
|
|
|
|
|
|
| W32/IRCbot.worm |
W32/Checkout, W32.Mubla, W32/IRCBot-WB, and Backdoor.Win32.IRCBot.aaq |
Trojan Worm |
Backdoor |
June 1, 2007 |
|
|
|
It provides a backdoor server and allows a remote intruder to gain access and control over the computer via an IRC channel. |
| WANK |
OILZ |
|
|
October 1989 |
|
|
|
Spread a pacifist, anti-nuclear political message |
| Welchia |
Nachia |
|
|
|
|
|
|
A helpful worm meant to install security patches. |
| Witty |
|
|
|
March 19, 2004 |
|
|
|
Appeared very rapidly after announcement of Internet Security Systems vulnerability |
| Zotob |
|
|
|
|
|
|
Farid Essebar and Atilla Ekici |
|
