CNET también está disponible en español.

Ir a español

Don't show this again

Christmas Gift Guide
Internet

Viruses play the name game

It's antivirus software manufacturers taking cues from the virus itself who name the buggers, according to antivirus personnel from various firms.

Who named the Melissa virus? And how did it get a glamorous name, unlike its virus cousins such as "Bozo"?

The answer is simple: Antivirus software manufacturers get naming rights to viruses, but generally they take their cue from the programming instructions or behavior of the virus itself, according to antivirus personnel at Network Associates, Symantec, and TrendMicro.

By convention, the antivirus community avoids giving viruses the names suggested by their authors. The Bozo virus, for example, was an unflattering term selected for the first Windows 95 virus, said TrendMicro's Dan Schrader.

"We try not to let the virus writers name the viruses," said Sal Viveros of Network Associates. "Getting their viruses proliferated [is like] vandalism or graffiti. We don't want to encourage that kind of behavior."

But avoiding the author's suggestion was a difficult task when it came to the Melissa virus that swept the globe after being released Friday. The term "Melissa" appears seven times in the virus code--and the last time, it's the name the author chose for the virus.

Symantec software engineer Raul Elnitiarto initially came up with the name "Mailissa," a combination of Melissa and the fact that it uses email to propagate. Elnitiarto was the first to deal with Melissa at his company.

But as is their habit, antivirus researchers quickly got together to settle on a common name, and in this case they decided to go with "Melissa." Despite the fact that author Kwyjibo suggested it, Melissa was an obvious name for the virus because one module of the code is called "Melissa," and the virus writes information to the Windows registry under the label "Melissa."

But the naming of viruses is getting more and more complicated as the viruses themselves evolve.

How Melissa works "We try to group by family," Elnitiarto said. However, "that's getting harder and harder with a lot of these new viruses coming out," because many viruses are hybrids that mix the reproductive mechanism of one virus with the payload of another, for example.

During such moments of confusion, the researchers categorize them by infection method. For example, a recent variation of Melissa called "Madcow" has been grouped with an earlier type of virus, the "Class" series, Elnitiarto said.

The Class virus, which Elnitiarto named after the fact that it tries to infect a module of a Word document called "Class," now has more than 120 variations, he said. That brings up another problem: running out of names.

Like the Melissa virus, hurricanes often have a human face by virtue of their names. But it can be a struggle to find new ones each year.

Hurricanes get alternating female and male names in alphabetical order, starting at A and rising through the alphabet as each hurricane season progresses. The system started during World War II with women's names only, but men's names were added in 1979. This year's schedule for the Atlantic includes Arlene, Bret, Cindy, Dennis, Emily, Floyd, and Gert, according to ExploreZone.

The antivirus community uses a simpler method to deal with the variations that often crop up among viruses. Like software revisions, they simply inherit a ".B" on the end. Papa, for example, was an ineffective Excel Macro-based variant on Melissa, but it was toothless. When a virus author fixed it, though, the new version was named Papa.B, Elnitiarto said.

Papa, one of the only Melissa variants Symantec actually has spotted in the wild, was named after a variable in the code, Elnitiarto said.

Tristate got its name from the fact that it could infect Word, Excel, and Powerpoint documents, he said.

Often viruses are named for the message they displayed on computer screens.

"One Half" is named for the message "Dis is one half." "Unashamed" could write the phrase "UNashamed Naked!" "Pathogen" generates the words: "Your hard-disk is being corrupted, courtesy of PATHOGEN!" Another virus, called "Angelina," contains the message, "Greetings for ANGELINA!!!" though the message is never displayed.

The naming is getting more standardized as time passes. For example, a prefix "W97M" indicates a Word 97 macro virus.

The worst is past
For its part, the worst of the Melissa virus is past, the antivirus researchers said.

"The initial effect was pretty big," said Elnitiarto. "It's died down."

"The big wave is really passed," agreed Viveros. "Most people are aware of the issue."

Interest in the virus has been strong, however. John Dickson, president of Coastline, registered the Melissavirus.com domain name on Friday after he saw the FBI warning.

"Melissa was different. It was spreading rapidly, and I wanted to get the word out," Dickson said in an email message to CNET News.com.

Traffic on the site was a relatively modest 1,100 unique visitors by Monday. On Wednesday it had blossomed to 38,000, and he estimated more than twice that traffic for today.