Malware nomenclature

Question

If there a generally agreed upon naming convention for types of malware/virus? For example, are there agreed upon terms for virus, trojan, worm and the like?

If one exists could someone explain it or link to an explaination?

Answer 1

As far as I'm aware there is no universal naming convention, only vendor-specific conventions.

For instance:

• McAfee: http://home.mcafee.com/VirusInfo/Glossary.aspx

• Symantec: http://www.symantec.com/security_response/virusnaming.jsp

• Sophos: http://www.facebook.com/note.php?note_id=13314014671

Each vendor has their own particular convention, but a lot of them to overlap.

Answer 2

Roughly, according to me:

• a virus got onto your system because it was 'carried' by something else;
• a worm got onto your system because it found a vulnerability in a network service on your system;
• a trojan got onto your system because you were duped into thinking it was a legitimate program and installed it

So this axis of classification is about how the malware is spread.

Once on your system, it doens't make much difference what sort of malware they are, although they are then more usefully classified by what they do: spyware, adware, etc.

Answer 3

Have a look at

http://www.wildlist.org/faq.htm#naming

http://www.wildlist.org/naming.htm

http://www.people.frisk-software.com/~bontchev/papers/naming.html