Re: Administrivia: Which virus is this?

as a followup to marc's excellent reminder of links, a couple of links
related to this that people may want to know about ...

        vgrep:  http://www.virusbtn.com/resources/vgrep/
        CME (from MITRE, forthcoming):
                
http://www.cbronline.com/article_news.asp?guid=11D11704-DE5B-45BD-AF4B-45D8F44E055C

vgrep is a great way to track virus names across vendors. the CME one
would just standardize the names and provide a common handle much like the
CVE does (at least it appears so at this point according to the article).

ideally some effort (maybe the CME) would contain info on ports bound and
services used, we'll see. i'm hopeful that someone will get a network
signature in the entries, as most AV vendors often lack detail on that
sort of thing (in favor of detail on effects on the host, ie registry keys
changed and DLL injections performed).

i just posted about those two links on wormblog moments before marc's
message arrived, and they seem topical.

________
jose nazario, ph.d.                     jose@monkey.org
http://monkey.org/~jose/                http://infosecdaily.net/