Patrick Lee
The May issue of Virus Bulletin highlights the lack of a 'universal naming and identification convention that's really nice' for viruses ("Hunting the UNICORN", VB May 2004, p.13-16) but the situation in Chinese is even worse. The names are often poorly translated and have a meaning totally unrelated to the original. Examples of the twisted Chinese naming include:
Novarg: from Norway to SCO?
The infamous Novarg (or MyDoom) worm first appeared in 27th January 2004. Rising named Worm.Novarg as “SCO炸彈”, which means “SCO bomb” presumably because the first and second variants of the MyDoom worm launched DDoS attacks on SCO’s web site. Rising still uses this Chinese name for all MyDoom variants. The most recent one, Worm.Novarg.n in 27th July 2004, is still referred to as “SCO炸彈”, even though the DDoS target is no longer SCO.
Jiangmin transliterated Novarg as “挪威客”, which means “Norwegian guest”. Well, I have no idea why the worm is related to a Scandinavian country.
References:
- “SCO炸弹”病毒邮件疯狂传播 2月1日攻击SCO网站[图]
- 病毒报告：瑞星截获SCO炸弹变种H(Worm.Novarg.h)
- http://www.jiangmin.com/exec/news_sys/news/jiangmin/virusinfo/newvirus/2004127212656.htm (link obsolete)
Bagle: an eaglet or a bad eagle?
Variants of another infamous worm, Bagle (or Beagle) were spreading again recently. This worm is so bad that Rising decided to translate W32.Beagle.K@mm as “惡鷹”, which means “bad eagle”. Why they don’t translate it as “bad beagle”, that’s another issue.
Jiangmin also chose the same theme, and named W32.Beagle.AB@mm as “雛鷹”, which means “eaglet”. This has a certain logic, as the worm uses an executable named bbeagle.exe, so if "bb" is taken as an abbreviation for baby, the whole name becomes baby eagle.
References:
- 病毒报告：瑞星截获恶鹰变种K(Worm.BBeagle.k)
- http://www.jiangmin.com/exec/news_sys/news/jiangmin/index/important/2004716165055.htm (link obsolete)
Does it matter?
Why bother about Chinese naming irregularities, when the International names are also in confusion? In most cases, the International names are similar across many developers, and they follow the CARO naming convention. Apart from defining a structure for the names, the convention recommends avoiding the names of people and companies. Using the name of an innocent company for a virus that has no direct connection is not appropriate, and, as the target of an attack can be changed without changing the structure of a virus, forward-thinking naming will never use such a name. The International names are also just that, International - by using the lowest common denominator, the ASCII character set, they can be displayed on any computer, which Chinese character names cannot. Viruses do not respect national boundaries, so erecting additional barriers to communication, by having names that are non-transferable, can only hamper the fight against viruses.