1

At this VirusTotal report we have detected a set of viruses with different names.

Every antivirus system provides its own virus names. Is it possible in some way to get a common virus name based on these aliases? Is there any online database that can provide such kind of service or something like that?

  • My guess would be that those are actually heuristics, not individual viruses. If that is true, it is not necessarily true that you could go from tripped heuristics to virus. It's also possible this virus has no common name because it is not widely known to the security community. – Stoud Oct 14 '16 at 2:26
2

The quick answer is "no".

Each anti-virus vendor examines the malware samples they find, determines a detectable "signature" for each, and creates a name for the malware. Malware names are often derived by the examiner who is looking at the unique text strings contained within the malware. Every few days they send an update to their paying clients with the new signatures and labels.

The anti-virus vendors don't often cooperate with each other because they're in competition. If my WowAV!! product detects 1,000,000 viruses, that's a reason I can market to people why they should buy my product over the competition, YawnAV, which only detects 900,000 viruses. So they don't share names, they don't share signatures, they don't share analysis.

  • Thanks for your answer. In the following example virustotal.com/en/file/… there are a lot of similar names, for example like: Trojan.Generic.6968728 from different vendors. How do they share this info ? – alexanoid Oct 14 '16 at 10:48
  • They don't share the info with each other. VirusTotal runs as many as 56 different anti-virus scanners against the files that are uploaded, and it simply outputs the names of each virus signature that each scanner detects. See virustotal.com/en/about/credits for the list. – John Deters Oct 14 '16 at 19:29
  • That's fine but in my example above we all can see a lot of equivalent malware names from different vendors. – alexanoid Oct 14 '16 at 19:31
  • So maybe some of the smaller/freeware AV vendors share signature files. That doesn't mean they all will, and it doesn't mean they will unite to create a global name database for them. The main reason is money: what's in it for Symantec, McAfee, or TrendMicro to cooperate? How would they make money from contributing to a common database of names? And just how would anyone benefit in any way from common names? Not even financially, just explain how it would make anything better for anyone in the security industry. VirusTotal is already delivering the benefit without forcing this cooperation. – John Deters Oct 14 '16 at 20:37
1

No. Each company has it's own rules for naming an analyzed virus.

However, sometimes, some companies do use a partial naming that has been used by the first one that came up with countermeasures.

  • Thanks for your answer. In the following example virustotal.com/en/file/… there are a lot of similar names, for example like: Trojan.Generic.6968728 from different vendors. How do they share this info ? – alexanoid Oct 14 '16 at 10:48
  • Those are taken from a 3rd parties (again, from the first ones detecting it) so the name is sometimes kept. Generic ones are usually kept like this because the big AV companies cannot state that they cured it first and there is no point in renaming them since a general decontamination solution (which is not custom made by a specific AV company) can be applied to clean them up. – Overmind Oct 14 '16 at 12:42

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.