One of the hardest things in virus writing is giving the virus its name. When you have a solid idea converted to code, have written it and tested it toroughly you have to think of something that you can identify it again when you see it showing up in the scanners and the newsgroups. The more viruses appear, the more difficult it is to think of yet another catchy name for your virus. I hope to present you some ideas here how to give your virus a name, where you can recognize it from when it gets in the wild.

Virus author confused with virus name

The thing that happens most is that virus researchers are going to group the viruses one author has written and next assign then numbers of their size. I can't think for a reason of this, probably because they will have problems using the Caro Naming Convention if they use these virus names. That's the only reason I can think of when they dubbed Andropinis to Rajaat.518. I'd rather hoped they would call it Rajaat.Andropinis. The thing you can do to twart their ideas, is the following:

Make your virus so that, if it activates, only displays the name of the virus, and not the author. The author string can be embedded in the code, but should not be written out to the screen. The insiders will recognize your name, the victims often not. Don't make the name of the virus too long. By this action, researchers are almost forced to use the name of the virus to identify it, because the end users that will see the activation will most often search for that name in the virus encyclopedias.

Make the activation catchy

One other thing you should to is trying to implement a payload that will be remembered by the user. Falling letters on your screen hardly will raise and eyebrow or two, but a mandelbrot figure, a nice character animation (look at Diametric/Matricide for an example), some high pitched noise (accompanied with subtle screen shakes) or strange messages on a Novell file server will do just fine in the sight of an ordinary end-user. This graphic payload does not indicate that you virus can not be destructive. You could erase random sectors with every note the virus plays of the Nutcracker Suite. Just remember to be creative. Let the virus overwrite the MSDOS icon to an upwards pointing middle-finger. Let your fantasy go wild, I expect to see fruits soon ;-)

Think of a good name

If your virus was fun to make, you wouldn't dare to let it wreak havoc without having you assigned a good name to it yet. Too choose names, you can let yourself get inspired with everyday life around you. Name if after that long legged chick running loose in your college. Dub it like your favorite (ehum?) politician. Call it like a pop star, or add a few lines of a songtext. Give it at least one word that will jump out of context, it will most probably the chosen word for identifying your virus. "Hello, I'm your new pal." won't do it, or you should have concatenated the last two words by mistake because then it will be called the Newpal virus, without doubt! Try catchy lines like:

I'm NEUROMANCER!
Spell my name right, it's Tarzan, not Trazan!

The worst case scenario is that researchers will choose Trazan as name instead of the hoped NEUROMANCER. Should you remove the ", not Trazan" part it will most probably appear in the wildlist as NEUROMANCER, with a 5% chance that your name will be added to it, if there is already a neuromancer virus that has got nothing to do with this one.

Encrypt all other strings

If you know the story of the Girafe virus, you know it's a Coffeeshop virus variant that uses a beta version of the TridenT Polymorphic Engine (TPE). But when the virus was decrypted, you could see numerous readable words, each pair of characters being the first two characters of certain files the virus avoids infecting. The writer of the virus didn't want to infect Gobbler II (GII.EXE), Remote Access (RA.EXE), and FastEcho (FECHO.EXE) (I assume he meant these files), this constructing the GIRAFE string. Other strings in the virus were the TPE marker and the initials of the author. One way to avoid these mistakes is to encrypt all the strings that must not be plainly visible. Priest has understood this trick, and very often encrypted string with an XOR in his viruses. Don't use initials in your virus, since a 'RG' is as large as an 'MZ' and won't be used. 'PS' could mean 'Phalcon/Skism', but also be a PUSH AX & PUSH BX opcode.

Make the name a remembrance

To ensure that everyone knows the name of the virus and your handle, you can make it known to them the very hard way. If your virus will destroy the contents of someones harddisk, then make it so that the user only will see the name of your virus on his screen during a dir command. Thinks of this: all your files gone and the volume on your harddisk is now "Rajaat haha", you will never forget who did this to you. Never. One of the virus names that are even known to non-virus related people is Michelangelo, a rather unremarkable virus, but is known for it's destructive actions performed on March the 6th. The virus recieved its name from the researchers and didn't contain a name. If it had a name in its code, it surely would have been called by that namen, even though it's a lame variant of the Stoned virus.

Don't use complex names

Don't use complex names in your virus, because people won't be able to remember the name very well. Never call it something like Breeblebrox, as it's a complex name to remember if you are not familiar with The Hitchhikers Guide to the Galaxy. Give the virus a name that most people will recognize or have a simple lexical structure. Hamanu is a simple name, even when people won't recognize the name as being a character (a Sorcerer King, to be more exactly) in the Dark Sun books, a series of novels brought out by T$R. It's is the same series of books I used to give myself a name (I'd be a blunted idiot if I'd use my real name, won't I?) and my MBR/COM infector (Andropinis, a bit tougher to remember). Rajaat is an easy name to remember, as it has no complex lexical structure. Names that are suitable are words like Maverick, Goldfinger, Witchboard, TopCat and Jetsons, as they all represent common movie names, cartoon figures or items that are well known. Don't assign a name to your virus like Prerequisite, Conquistador or Alapalooza. Name that are suitable are everlasting by their infamousy. Don't choose a name that will anger people, as that name won't be used. There are a few viruses that have the name Hitler, but researchers will shun that name. Ripper is an excellent example, as Jack the Ripper is a name that rings a bell at many people, and won't hurt anyone since it's so long ago that Jack roamed the dark streets of London.

Don't use names of people

Researchers won't name your virus the way you want it if it's a name of some person. An example is the Klaeren virus, which is now called different. Klaeren was a real name, and the person had nothing to do with the virus its creation. Better use fictive names that are not too real sounding. Think of names like Frodo, Sauron, Gallard, King Tec, Zaphod or Egami (Image reversed). Reversed names also are very suitable for viruses, like Natas and Nexiv_der.

Use a name that represents actuality

We virus writers are viewed upon as old-fashioned, and even if there are numerous WordBasic viruses, we mostly enjoy writing our viruses in assembler, whereas the researchers have first-class tools to their disposal. To let them show we react on recent news, you can best assign a name to your virus that shows it actuality. Call your virus Camilla, Pile of Shit (that stings!), Booza (drinking too much booze like boza will end up in names like these) or Setab (Bates reversed, I don't like this Jim Bates person at all, as do all virus writers down here). To regular MTV watchers I suggest Cornholio as the perfect virus name ;-)

Don't stress the name of the virus

Don't stress the fact that a virus is called a certain way by you. We have seen this with the Bizatch virus, now better known as Boza. Since Quantum actually almost PLEADED to have the virus called Bizatch, the researchers called it Boza, just in spite. If I even DARE to add a string in Diametric/Matricide that is even remotely saying something like "You little fuckheads, call this virus Diametric/Matricide, or I'll bash your brains out!" they would most probably call it Rajaat.BrainBash or something equally similar. Just make sure that only the name is of the virus is easily recognized and additional strings must be hidden from the users view.

Conclusion

You can never FORCE a researcher to name your virus as you wanted it, but you can give them a push in the good direction. Reading this article is of course not an insurance your virus gets the name you want it, but it will certainly be of great help. I am curious myself how they will call my Diametric/Matricide virus, since the name mutates (that's very easy with a XOR key and an anagram). Maybe they will call it the same as I referred to it when the development of it was in beta stage (Hamanu was the name). I am afraid I've acquired myself a sort of Microsoft image with assigning project names to viruses when they are not finished.