RE: AV Naming Convention

["Clairmont, Jan M" <jan.m.clairmont () citigroup com>]

IT would be an automated naming based on first time of discovery and reporting, there could be aliases added for the 
bugger.
This could be for searching for Mydoom.b Mydoom.c etc. variant rather trying t search for a name like 
Virus20040908.19:24:31.8843 time stamped variants.

Similar or equal virus would later be eliminated or archived for
information.  Standard record stamping for a database like Oracle.  Maybe Oracle could be persuaded to provide an
international database, great public service, providing needed
information to reduce spam, and virus spreading etc.


Good questions, good answers out there.
Jan Clairmont
Firewall Administrator/Consultant


-----Original Message-----
From: full-disclosure-admin () lists netsys com
[mailto:full-disclosure-admin () lists netsys com]On Behalf Of Randal, Phil
Sent: Tuesday, August 10, 2004 11:07 AM
To: full-disclosure () netsys com
Subject: RE: [Full-disclosure] AV Naming Convention


> I have to agree with Todd, the naming convention is now right 
> useless for the normal population and make keeping up with 
> viruses on a corporate level that much harder. AV companies 
> are always trying to beat the other company and this leads to 
> very little information sharing between the companies on new 
> viruses, etc.
>
> Maybe a foundation should be created. This foundation could 
> give a seal of approval to all AV corporations that join in. 
> We are starting to make rules for patch management over at 
> patchmanagment.org. Why couldn't a group work with AV names 
> and the first company that finds and IDs it correctly gets to 
> name it in the foundation. Just a dream, I would guess.

This completely misses the point.  When a new virus is discovered, it is
essential that there is a RAPID response to the threat.  The idead of
handing the critter over to a committee to decide it's name is, quite
frankly, plain bonkers.  I for one would rather all the antivirus
vendors came up with their own names if it meant that
detection/disinfection patterns came out hour earlier.

Cheers,

Phil

----
Phil Randal
Network Engineer
Herefordshire Council
Hereford, UK

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html