RE: Virus LIRVA[Scanned]

"Nizam S" <snizam@globalsw-in.com> wrote:

> Sophos has sent the IDE file to their customers for this worm. But the

Yes.

One clue is that many AV researchers do not like "encouraging" virus writers by naming their viruses as the writer of this virus clearly wished it to be called "Avril". Another clue is that regardless of their position on the "encouragement" issue, many AV researchers prefer to not name viruses after real people and this virus was clearly intended to be named after someone. Armed with this information about naming practices the fact that "lirva" is "avril" reversed should also be seen as a clue that these are the same thing, as a not uncommon practice when naming viruses is to take the obvious-but-unacceptable-for-whatever-reason name and reverse it if it makes a pronouncable "word". (A variation on that is to swap syllables or reverse the letters in the first syllable(s).)

Further, some AVs are calling this same virus "Naith". This "name" was suggested by MessageLabs when they got a flood of messages with this virus attachment and, at a loss for a name, suggested -- presumably intending it to be a temporary name -- "NAme Is THis" == "Naith"...

Finally, Kaspersky Labs already had detection for two previous variants of this virus. KL stuck with the name they assigned the first member of the family last December -- Avron -- and as this is the third variant by their reckoning, it is known by their scanner as Avron.C.

-- 
Nick FitzGerald
Computer Virus Consulting Ltd.
Ph/FAX: +64 3 3529854