How do AV vendors choose malware names?

Question

If you take a look at McAfee's recent malware page, you'll see that the names in the "Malware name" column aren't very human-readable: Downloader.a!cnz, W32/Autorun.worm.bgh, FakeAlert-SecurityTool.fx, etc.

These names have always puzzled me a little. There seems to be a lot of information encoded in these names, but I can't readily make sense of it, and I can't find any kind of guide for reading them.

• Are there well-defined standards (or at least common practices) when it comes to naming malware, or is it up to the whims (or proprietary standards) of each vendor?
• Is there a well-understood vocabulary (e.g. does "Autorun" have a standard specific meaning, like "relies on Windows autorun functionality"), and do the symbols (!, .) have a fixed particular meaning?
• Do the TLD-like suffixes like .ml indicate suspected country of origin, or am I reading that wrong?

I'm aware that different anti-virus vendors may have different naming styles. I'm primarily interested in McAfee, but a good answer might point to multiple references for how each vendor assigns malware names or simply provide a high-level overview of how malware naming works.

Answer 1

Microsoft uses the CARO naming scheme:

Mitre came up with the CME:

The Common Malware Enumeration (CME) initiative aims to provide single, common identifiers to new virus threats (i.e., malware) and to the most prevalent virus threats in the wild for the benefit of the public. Managed and maintained by The MITRE Corporation, CME is not an attempt to solve the challenges involved with naming schemes for viruses and other forms of malware. Instead, it is an effort to facilitate the adoption of a shared, neutral indexing capability for malware.

Another article about naming.

Answer 2

A lot of the names come from strings present within the malware - it is an easy way to name the code, as there are so many thousand new viruses/trojans etc every day., so researchers would rapidly run out of cool names.

Suffixes seem to sometimes be based on the type of file or the type of attack, rather than a location TLD.

In general I wouldn't worry about the name or what it means (aside from families of virusesmalware being categorised together eg exampletrojan.a, exampletrojan.b etc) and just use it as an identifier.