Virus naming chaos causes confusion

A need to standardise the naming of viruses has become apparent after the same virus was given at least four different names by antivirus vendors.

Trend Micro this week issued an alert for a virus it calls VBS_Columbia, a Love Bug variant, which spreads itself by email. Rival vendor Symantec said the virus was actually discovered several weeks ago and is called VBS.Plan.A. Sophos calls it Loveletter.AS and Network Associates calls it Loveletter.AV.

With one virus having several names, users could face problems trying to identify whether or not they are protected by a particular antivirus package.

Jack Clark, product manager at Network Associates, said: "When a virus is found, within a couple of hours different companies will bestow several different names on it. But within a week, most companies will have settled on a single name. It would be handier to have a central naming system."

Eric Chien, chief research at Symantec, said antivirus companies used to try to stick to the CARO (Computer Antivirus Research Organisation) rules. CARO is an informal organisation set up to tackle issues such as naming viruses and collecting samples.

"This involved using prefixes such as VBS and suffixes such as 'worm', so that you could get an idea of what the virus actually is," he said.

Stewart Taylor, head of Sophos' virus labs, said the scheme wasn't working because it was difficult for new companies to join. "It's a bit of an old boys' network. Also, people don't like renaming viruses, so if they have already given it a name, they are unlikely to change it later on. It's a nightmare."

Taylor said a standardised naming system would mean all the antivirus companies having to work together. "There are too many vetoes, some companies that won't work with others - too much history," he said.

Taylor advised users to sign up to more than one antivirus vendor's virus alert and compare descriptions to check for protection. He also recommended that users have more than one antivirus package - "but not on the same machine, as they could fight each other. Put one on the desktop and the other on the server or gateway."

"I recommend using more than one because someone will always be first with a fix - but someone will always be last," he added.