No Solution at Hand for the Malware Naming Mess

No Solution at Hand for the Malware Naming Mess
( Page 1 of 2 )

Opinion: I'm rooting for the Common Malware Enumeration initiative to succeed, but I'm thinking it's just going to be another name in an already crowded field.In the heat of a malware outbreak there is usually a lot of confusion about what variant of what worm is involved? Is it just a new variant or a completely new worm?

Inconsistencies between vendors about variant indices and virus names add to the confusion.

The latest effort to address this problem is the CME (Common Malware Enumeration) Initiative from a company called MITRE but sponsored by US-Cert. These are the same people who brought us CVE (Common Vulnerabilities and Exposures), the project on which CME is based.

Resource Library:

The idea is to assign a specific identifier to each malware implementation.

To illustrate the problem, consider the table below containing data from AV-Test, a research project at the Otto-von-Guericke University Magdeburg (Germany).

Anti-Virus Product	ID For This Virus
AntiVir	TR/Bagle.DG
AVG	I-Worm/Bagle
BitDefender	Win32.Bagle.JK@mm
ClamAV	Worm.Bagle.BW
Command	W32/Mitglieder.FS
Dr Web	Win32.HLLM.Beagle.35146
eSaf	Trojan/Worm (suspicious)
eTrust-INO	Win32/Glieder.BN!Trojan
eTrust-VET	Win32.Glieder.BV
Ewido	Worm.Bagle.ds
F-Prot	W32/Mitglieder.FS
F-Secure	Email-Worm.Win32.Bagle.ds
Fortinet	W32/Bagle.DA-tr
Ikarus	Email-Worm.Win32.Bagle.gen
Kaspersky	Email-Worm.Win32.Bagle.ds
McAfee	New Poly (virus or variant)
Nod32	Win32/Bagle.CT worm
Norman	W32/Bagle
Panda	W32/Bagle.EN.worm
QuickHeal	Bagle.ds
Sophos	Troj/BagleDl-U
Symantec	Trojan.Tooso.Q
Trend Micro	TROJ_BAGLE.DA
VBA3	Email-Worm.Win32.Bagle.ds
VirusBuster	Trojan.DL.Bagle.Gen!Pac3

Next Page: What CME is up against.

>>> More Network Security & Hardware Articles          >>> More By Larry Seltzer