Fusion Source Technologies - Virus Naming Conventions

	AntiVirus Center
	Security & Hacking
	SPAM Information
	Windows Support
	Free Email Resources

AntiVirus Research Center
Virus Naming Conventions

When searching for a Virus Name, you should be aware of the Naming Convention used by Norton AntiVirus. Virus names consist of a Prefix, the Name, and often a Suffix:

The Prefix denotes the platform on which the virus replicates or the type of virus. DOS viruses usually do not contain a Prefix.
The Name is the family name of the virus.
The Suffix may not always exist. Suffixes distinguish between variants of the same family and is usually a number denoting the size of the virus or a letter.

These are formatted as Prefix.Name.Suffix. For example, WM.Cap.A would be the A variant of the Cap family. The WM means the virus is a Word Macro virus. The following prefixes should help you in searching for viruses.

Prefixes

WM:	Word Macro viruses that replicate under Word6.0 and Word95 (Word7.0). They may also replicate under Word97 (Word8.0), but are not native to Word97.
W97M:	Word97 Macro viruses. These are native to Word97 and replicate under Word97 only.
XM:	Excel Macro viruses that are native to Excel5.0 and Excel95. These viruses may replicate in Excel97 as well.
X97M:	Excel Macro viruses that are native to Excel97. These viruses may replicate under Excel5.0 and Excel95 as well.
XF:	Excel Formula viruses are viruses using old Excel4.0 embedded sheets within newer Excel documents.
AM:	Access Macro viruses that are native to Access95.
A97M:	Access Macro viruses that replicate in Access97.
W95:	Windows95 viruses that infect files under the Windows95 operating system. Windows95 viruses often work in Windows98 also.
Win:	Windows3.x viruses that infect files under the Windows3.x operating systems.
W32:	32-bit Windows viruses that can infect under all all 32-bit Windows platforms.
WNT:	32-bit Windows viruses that can infect under the Windows NT operating systems.
HLLC:	High Level Language Companion virus. These are usually DOS viruses that create an additional file (the companion) to spread.
HLLP:	High Level Language Parisitic virus. These are usually DOS viruses that attach themselves to host files.
HLLO:	High Level Language Overwriting virus. These are usually DOS viruses that overwrite the host file with viral code.
Trojan/Troj:	These files are not viruses, but Trojan Horses. Trojan Horses are files that masquarade as helpful programs, but turn out to be malicious code. Trojan Horses do not replicate.
VBS:	Viruses that are written using the Visual Basic Script programming language.
AOL:	Trojans that are specific to America Online environments and usually steal AOL password information.
PWSTEAL:	Trojans that steal passwords.
Java:	Viruses that are written using the JAVA programming language.