What metrics are available on malware?

Question

All the main AV have a risk rating or severity level, how do they determine what is "low","high",etc.?

Answer 1

Each company will use a different scale, but they all will likely be the result of a weighted score considering:

• if it escalates itself
• the damage it causes
• if it disrupts communication
• how hard it is to block/remove
• how easy it is to get infected
• how it gets passed on to other machines

Here is a similar scale: http://reviews.cnet.com/4520-6600_7-6274750-1.html

Symantec rates malware based on reputation and behavior classification and doesn't use a 'low-high' scale anymore.