Interview with Lockdown | Main Page | Trojan List | NoHack | SwatIt | Submit a virus |

Last update July 10, 2002

Common Trojan List

If you don't see the trojan or virus you are searching for, please email tinfo@trojaninfo.com with the subject heading "virus info"

This document is arranged by resources first, then the virus/trojan list. The virus/trojan list is alphabetical by alias, so if you don't know the full name it is easier to find.

This is not an exhaustive resource. It is simply meant to make life easier for NoHack Helpers

Go to top of Trojan List

Resources

• Hoaxes
• • Trend Hoax List
  • Jdbgmgr.exe file hoax


• libraries
• • McAfee Virus Library
  • Sophos Virus Library
  • Symantec Virus Library
  • Trend Virus Library
  • Trend Realtime Virus Tracker
  • NoHack
  
  
• lockdown
• • Swat It Review & Download
  
  
• Submit a Virus
• • Trend
  • Norton

Trojan/Virus List

• Aplore
• • WORM_APLORE.A (Trend)
    ---(alias: APLORE.A, Worm.PSecure, APLORE)
  • VBS_APHEX.A (Trend)
    ---(alias: APHEX.A)
  • W32.Aplore@mm (Norton)
    ---(alias: W32.Aphex@mm, Bloodhound.VBS.Worm, I-Worm.Aphex, W32/Aplore-A, W32/Aplore@MM, Win32.Aphex, WORM_APLORE.A)
  • Aplore (FSecure)
    ---(alias: Aphex, I-Worm.Aphex, Psec)
  • W32/Aplore-A (Sophos)
    ---(alias: Aphex, Win32/Aphex.Worm, W32.Aphex@mm)
  
  
• Back Orifice
• • Bkdr_bo2k (Trend)
  • Bkdr_orifice.con (Trend)
  • Information on Back Orifice (Norton)
  
  
• Bhong
• • W97m_bhong (Trend)
  
  
• Badtrans
• • ---Sample Attachment names: card.DOC.pif docs.DOC.pif fun.MP3.pif HAMSTER.DOC.PIF Humor.MP3.scr IMAGES.DOC.pif Me_nude.MP3.scr New_Napster_Site.MP3.pif Pics.DOC.scr README.MP3.scr S3MSONG.DOC.scr SEARCHURL.MP3.pif SETUP.DOC.scr Sorry_about_yesterday.MP3.pif Sorry_about_yesterday.MP3.scr stuff.MP3.pif YOU_ARE_FAT!.DOC.pif YOU_are_FAT!.MP3.scr
  • Badtrans.a (Trend)
    ---(alias: BADTRANS, BADTRANS.A, W32.Badtrans.13312@mm, I-WORM.BADTRANS)
  • Badtrans.b (Trend)
    ---(alias: W32/Badtrans-B, BADTRANS.B, W32/Badtrans@MM, W32.Badtrans.B@mm, W32/BadTrans.B-mm)
  • W32/Badtrans-B (Sophos)
    ---(alias: -Worm.BadtransII, WORM_BADTRANS.B)
  
  
• Benjamin.Worm
• • W32.Benjamin.Worm (Norton)
  • W32/Benjamin.worm (McAfee)
  • Worm.Kazaa.Benjamin (Kaspersky)
  
  
• CIH
• • CIH VIRUS FREE Data Recovery (GRC)
  • W95.CIH.1049 (Norton)
    --- alias: Bloodhound.W32.EP
  • W95.CIH (Norton)
    --- alias: Chernobyl, PE_CIH, Win95.CIH, Win32.CIH, W95/CIH.1003, CIH.Spacefiller
  • CIH (FSecure)
  • CIH (Cert)
  
  
• Chernobyl (aliases: VBS/Nobyl, Freepics, Story.vbs)
• • vbs_chernobyl (Trend)
  • VBS/Nobyl (McAfee)
  • VBS.Story (Norton)
  
  
• Choke
• • W32.Choke.Worm (Norton)
  • W32/Choke (Sophos)
    --- alias: I-Worm.Choke, Win32.Choke, W32/Choke.Worm
  
  
• Destiny.a
• • Troj_destiny.a (Trend)
  
  
• Dmsetup
• • Buny (NoHack)
  • Dmsetup (NoHack)
  • Dwsetup (NoHack)
  • Jpg.com (NoHack)
  • Popups5 (NoHack)
  • Troj_dmsetup (Trend)
  • Troj_dmsetup.a (Trend)
  • Troj_dmsetup.c (Trend)
  • Troj_dmsetup.d (Trend)
  • Troj_dmsetup.f (Trend)
  
  
• Doly
• • Troj_doly (Trend)
  • Bkdr_doly15.b (Trend)
  • Bkdr_doly.16 (Trend)
  • Bkdr_doly.20 (Trend)
  
  
• DSNX
• • Backdoor.DSNX Norton
  • BackDoor-UK McAfee
  • BKDR_DSNX.A Trend
  
  
• Elkern
• • W32/Elkern.cav McAfee
  • W32.Elkern.4926 Norton
  • W95/Elkern F-Secure
  
  
• Exbuz
• • NoHack
  • VirusHelp
  
  
• Fable
• • VBS.Fable.Worm (Norton)
  • VBS.Fable.Worm (2) (Norton)
  • VBS.Fable.Worm (3) (Norton)
  
  
• FreeLove
• • VBS.Freelove.A (Norton)
  • VirusHelp
  
  
• Goner
• • W32.Goner.A@mm (Norton)
  
  
• GTbot (alias: Aristotles)
• • NoHack
  • Fruit^Loop
  • Golcor
  • Lockdown
  
  
• Haptime
• • VBS.Haptime Fix (Norton)
  • VBS.Haptime.A@mm (Norton)
    ---(alias: VBS.HappyTime, VBS_HAPTIME.A, VBS.Happytime.A, VBS/Help, VBS_Haptime.A, VBS/Haptime@MM)
  • VBS.Haptime.B@mm (Norton)
    ---(alias: VBS.Haptime.A@mm, VBS/Haptime.A@mm)
  • VBS.Haptime.C@mm (Norton)
  
  
• JDay
• JAVA_JDAY.IRC (Trend)
  
  
• jpg.bat
• Fix file (NoHack)
  
  
• JS.Exception
• • JS.Exception.Exploit (Norton)
  • JS_EXCEPTION.GEN (Trend)
  
  ---(alias: Trojan.Seeker-based, HTML.VMExploit, JS.Exception.Exploit, EXCEPTION, EXCEPTION.GEN, Coolsite, Coolsite.A, JS/Coolsite.A)
  
  
• js.seeker
• • Norton
  • Trend
  
  
• Judgement Day (mIRC)
• • Judgement Day (NoHack)
  
  
• Karma (server.ini)
• • Golcor
  • Trend
  
  
• Klez
• • General description (Trend)
  • WORM_KLEZ.E (Trend)
  • W32/Klez.gen@MM McAfee
  
  
• Life Stages (alias: IRC/Stages.worm, Life_Stages Worm, VBS_Stages.A, Bloodhound.VBS.Worm)
• • VBS.Stages.A (Trend)
  • VBS.Stages.A Fix (Norton)
  
  
• Links.VBS
• • Links.VBS (NoHack)
  • VBS.Freelink (2) (Norton)
  • VBS.Freelink (3) (Norton)
  • VBS.Freelink.B (Norton)
  • VBS.Freelinks.C@mm (Norton)
  • VBS.Freelinks.F@mm (Norton)
  • VBS.Freelinks.G@mm (Norton)
  
  
• Loveletter (alias: Lovebug, I-Worm.LoveLetter, VBS/LoveLetter.A, VBS/LoveLet-A)
• • VBS.LoveLetter and variants (Norton)
  • VBS.LoveLetter Fix (Norton)
  • VBS.LoveLetter.A (UPDATE) (Norton)
  • VBS.LoveLetter.AS (Norton)
    ---(alias: VBS.Plan.A, VBS.LoveLetter.Variant, VBS.President.Worm, VBS/Columbia, I-Worm.Plan)
  • VBS.LoveLetter.BD (Norton)
    ---(alias: Loveletter.AD, VBS/Contract, Trojan.PSW.Hooker.24.c)
  • VBS.LoveLetter.BE (Norton)
    ---(alias: VBS.LoveLetter.Variant)
  • VBS.LoveLetter.BJ (Norton)
    ---(alias: VBS.LoveLetter.Variant, I-Worm.LoveLetter, VBS/Loveletter@MM, VBS.Plan.D )
  • VBS.LoveLetter.BM (Norton)
    ---(alias: VBS.President.Worm, VBS/Columbia, VBS.LoveLetter.Variant, VBS.Plan.B)
  • VBS.LoveLetter.CA (Norton)
    ---(alias: VBS.LoveLetter.Variant, I-Worm.Loveletter, VBS/LoveLetter@MM)
  • VBS.LoveLetter.CD (Norton)
    ---(alias: CARTOLINA.A, VBS_LOVELETTER.CD, VBS/LOVELETTER.CD, VBS/JER)
  • VBS.LoveLetter.CH (Norton)
    ---(alias: VBS/Linda.A, VBS.Vbswg2.gen)
  • VBS.LoveLetter.cl@mm (Norton)
    ---(alias: IRC.Worm.gen, HTML.ILoveYou.CL, VBS/LL-CL, I-Worm/Love.Echelon)
  • VBS.LoveLetter.cn@mm (Norton)
    ---(alias: VBS.Loveletter.CM@mm (AVX), VBS.Lopez.A@mm, JENNIFERLOPEZ_NAKED.JPG.vbs)
  • VBS.LoveLetter.cu@mm (Norton)
    ---(alias: I-Worm.Natiday, VBS.NDay.A@mm, VBS.Natiday, VBS/Ndpp-A)
  • VBS.LoveLetter.cw@mm (Norton)
    ---(alias: VBS.Retnal.A@mm, Bloodhound.VBS.Worm)
  • VBS_COLOMBIA (Trend)
    ---alias: COLOMBIA, vbs/plan.a, plan.a, VBS/LoveLetter.worm, Vbs.Plan.A, VBS.LoveLetter.Variant, VBS/Loveletter.AS
  • VBS.Plan (Norton)
    ---alias: VBS.President.Worm, VBS/Columbia, VBS.LoveLetter.AS, VBS.LoveLetter.BJ, I-Worm.Plan
  • VBS/Loveletter.as (McAfee)
  
  
• Movie.avi.pif
• • Movie.avi.pif (NoHack)
  • mIRC/Movie-A (Sophos)
  • Movie.avi.pif (Fruit^Loop)
  
  
• MTX (alias: W95.Oisdbo, W95.MTX.dr, W95.MTX (.dll), W32/Apology-B
• • W95.MTX (Norton)
  
  
• Mypics.vbs
• • Mypics.vbs Fix (RichG)
  • W32.Mypics.Worm (Norton)
  • W32.Mypics.Worm.36352 (Norton)
  • W32/MyPics (Sophos)
  • W32/Mypics.worm.34304 (McAfee)
  • W32/Mypics.worm.27648 (McAfee)
  • W32/Mypics.worm.25600 (McAfee)
  
  
• Netbus
• • Netbus (Hackfix)
  • BKDR_NBSPY.B (Trend)
    --- alias: TROJ_BACKDOOR.N3, TROJ_BACKDOOR.NB, TROJ.BACKDOOR.Nx, NetBus.2.Trojan, BACKDOOR.N3, NBSPY.B, NBSPY
  
  
• Netdevil
• • Backdoor.NetDevil (Norton)
  • BackDoor-RP (McAfee)
  
  
• Network.a
• • TROJ_NETWORK.A (Trend)
  
  
• Newbiero
• • BKDR_NEWBIERO.A (Trend)
    --- alias: ACEBO
  • Newbiero (FSecure)
    --- alias: Worm.Newbiero, I-Worm.Newbiero
  • Worm.Newbiero (AVP)
    --- alias: Worm.Newbiero, I-Worm.Newbiero
  
  
• Nkie alias: $decode worm
• • Trojaninfo
  
  
• Nimda
• • W32.Nimda.A@mm (Norton)
  • W32.Nimda.A@mm Removal Tool (Norton)
  • W32.Nimda.A@mm (Norton)
  • W32.Nimda.B@mm (Norton)
  • W32.Nimda.C@mm (Norton)
  • W32.Nimda.E@mm (Norton)
  • W32.Nimda.E@mm Removal Tool (Norton)
  • W32.Nimda.I@mm (Norton)
  • W32.Nimda.J@mm (Norton)
  
  
• oblivion.b2 (alias: mini-Oblivion)
• • Bkdr_oblivion.b2 (Trend)
  
  
• Noob
• • VBS_TROJNOOB.A (Trend)
  • Trojan.IRC.Noob.gen (Norton)
  • VBS.Trojan.Noob (Norton)
  • VBS/Noob-A (Sophos)
  
  
• PE Spaces
• • W95.Spaces (Norton)
    ---alias: W95.Spaces.1633, W95.Spaces.1245, W95.Spaces.1445, W95/Busm.1445, W95/Busm99.1445
  • Spaces (Trend)
    ---alias: Busm
  • W95/Spaces (Sophos)
    ---alias: PE_Spaces.1633
  • W95/Spaces (McAfee)
    ---alias: W95/Spaces.GR
  • Win95/Spaces.1633 (McAfee)
    ---alias: Win95/Spaces.1245
  
  
• Pretty Park
• • PrettyPark (NoHack)
  • PrettyPark.Worm (Norton)
  • PrettyPark (F-Secure)
    ---alias: Pretty Park, I-Worm.PrettyPark
  
  
• Sircam
• • W32.Sircam.Worm@mm (Norton)
  • W32.Sircam.Worm@mm Removal tool (Norton)
  • W32/Sircam (Cert)
  
  
• Sasser
• • W32.Sasser.Worm (Norton)
  • W32.Sasser Removal Tool (Norton)
  • Sasser (F-Secure)
  • W32/Sasser.worm.a (McAfee)
  
  
• Sockets De Troie (alias: Blazer5)
• • Sockets de Troie (quartzo)
  • Sockets de Troie (commodon)
  • Win32.HLLP.DeTroie (FSecure)
• Sua.a
• • Troj_sua.a (Trend)
  
  
• Sub7
• • SubSeven - Introduction (Hackfix)
  • BackDoor-Sub7 (McAfee)
  • SubSeven (FSecure)
    --- alias: Backdoor-G, Backdoor.SubSeven, Sub7
  • BackDoor.G (Norton)
    --- alias: Backdoor.Trojan
  
  
• Tune.VBS
• • VBS.Tune (Norton)
    --- alias: IRC.Tune
  • Tune (FSecure)
  • VBS/Tune@MM (McAfee)
  
  
• Weird (alias: Win32.Weird, W95.Weird)
• • W32.Weird (Norton)
  
  
• YAHA (alias: Win32.Weird, W95.Weird)
• • WORM_YAHA.F (Trend)
  • W32/Yaha-C (Sophos)
  • W32/Yaha-E (Sophos)
  • W32.Yaha@mm (Norton)
  • W32.Yaha.B@mm (Norton)
  • Yaha.E (F-Secure)
    --- alias: -Worm.Lentin.G, Lentin.G, Lentin, Yaha, W32/Lentin.F@mm