Share via

What does "!rfn" mean in a virus's definition name?

Anonymous
2016-04-13T15:43:25+00:00

I'm just interested in its meaning. What does "!rfn" mean?

Windows for home | Windows 10 | Security and privacy

Locked Question. This question was migrated from the Microsoft Support Community. You can vote on whether it's helpful, but you can't add comments or replies or follow the question.

0 comments No comments

Answer accepted by question author

  1. Anonymous
    2016-05-19T08:59:04+00:00

    Now, the MMPC sends this new reply to the original request as if the others didn't exist: 

    I suppose we aren't meant to know or even suspect anything about some.  Alas.

    What we do know from https://www.microsoft.com/security/portal/mmpc/shared/malwarenaming.aspx?platform=hootsuite is they name the malware and unwanted software that we detect according to the Computer Antivirus Research Organization (CARO) Malware naming scheme.

    This scheme uses the following format:

    This suffix is apparently called Additional Information:

    Additional information

    Additional information is sometimes used to describe a specific file or component that is used by another threat in relation to this threat. In the example above, the !lnk indicates that the threat is a shortcut file used by the Trojan:Win32/Reveton.T variant, as shortcut files usually use the extension .lnk.

    We also have the "far less than random" listing of those available and their meanings (or lack thereof):

    Additional suffixes

    • Suffixes

    .dam: damaged malware

    .dll: Dynamic Link Library component of a malware

    .dr: dropper component of a malware

    .gen: malware that is detected using a generic signature

    .kit: virus constructor

    .ldr: loader component of a malware

    .pak: compressed malware

    .plugin: plug-in component

    .remnants: remnants of a virus

    .worm: worm component of that malware

    !bit: an internal category used to refer to some threats

    !dha: an internal category used to refer to some threats

    !pfn: an internal category used to refer to some threats

    !plock: an internal category used to refer to some threats

    !rfn: an internal category used to refer to some threats

    !rootkit: rootkit component of that malware

    @m: worm mailers

    @mm: mass mailer worm

    At the bottom is a section for feedback.  I imagine I might provide some after a while.

    I've requested an explanation, but think it may be time to stop pursuing this in this Forum (at least for me). At least we know - even from the latest above - they are suffixes and are used internally (so they must mean something to them and thus can't be completely random) even if we never, ever learn anything further beyond those they did define (so we have no choice at present but to ignore them as internally proprietary and meaningless to us).

    Kosh

    3 people found this answer helpful.
    0 comments No comments

11 additional answers

Sort by: Most helpful
  1. Anonymous
    2016-05-19T09:08:14+00:00

    Strange how wishy-washy and confusing those MMPC replies are!

    Nevertheless: Kosh, thanks much for trying to get some simple information from MMPC :)

    Best wishes,

    Julia

    1 person found this answer helpful.
    0 comments No comments
  2. Anonymous
    2016-04-15T16:34:59+00:00

    Bassie, FWIW:

    Some hours ago I asked if your question (+ mine, too ;)) could be escalated so that we receive a real reply (see http://answers.microsoft.com/en-us/feedback/forum/fdbk_commsite-mods/moderation-requests-week-of-apr-11-2016/839a9ac5-876e-4745-8670-a93644e7f25c?page=8).

    None of the Community Moderators replied but a friend, Kosh Vorlon , did.

    He tweeted (or whatever that is called) to MMPC Twitter (msftmmpc ) https://twitter.com/KoshVorlon :

    So, hopefully, one or the other of the MMPC guys will sooner or later supply an answer...

    Cheers,

    J

    1 person found this answer helpful.
    0 comments No comments
  3. Anonymous
    2016-04-13T21:29:10+00:00

    I, too, would like to know what exactly the !rfn information stands for.

    Unfortunately, I can't find any precise information on the following pages from Malware Protection Center:

    How we name malware

    or

    Glossary

    1 person found this answer helpful.
    0 comments No comments
  4. Anonymous
    2016-04-13T20:03:11+00:00

    As in Trojan:Win32/Dorv.A!rfn or Trojan:Win32/Dorv.B!rfn or Trojan:Win32/Skeeyah.A!rfn or...?

    Answer-by-number:

    1. Did the computer come with Win10 preinstalled or did you upgrade a Win7 computer or a Win8.1 computer [PICK ONE] to Win10?
    2. Has a Norton application or a McAfee application EVER been installed on the computer since you bought it?
    3. Did a Norton free-trial or a McAfee free-trial [pick one] come preinstalled on the computer when you bought it? (Doesn't matter if you never used or Activated it.)
    4. Assuming neither a Norton application nor a McAfee application is installed now, have you ever run the Norton Removal Tool and/or the McAfee Consumer Products Removal Tool?
    • Fact: Norton and McAfee applications are notorious for not uninstalling or upgrading cleanly. The "leftovers" may be your troublemaker here.
    0 comments No comments