While analyzing a binary online through the virustotal service , I found out that different AVs named the binaries differently.For instance, for that same binary Norman named it Obfuscated_A, Symantec named it WS.Reputation.1 and another AV named it Malware-Cryptor.General.2 .Is there any specific naming convention adopted by the AVs?
Different AV vendors use different naming conventions. Many of them describe these conventions on their websites. For example:
AV vendors will sometimes try to use the same names as other AV vendors for well-known malware families, but this is not guaranteed and is becoming less and less common. For example, Microsoft, Sophos, CA, and McAfee all refer to the well-known Conficker family as "Conficker", but Symantec refers to it as "Downadup".
Even when AV vendors agree on a family name, they will hardly ever be in-sync on variant names. So for example, a file detected by Microsoft as Conficker.B might be detected by CA as Conficker.C.
This is why whenever you want to refer to a specific malware variant, it's always best to give the detection name and the AV engine name. Or better yet, just give the file hash and let people look it up on a site like VirusTotal.
Something to take into consideration is generic detection names. Generic detections are designed to catch as many malware samples as possible while avoiding false positives. They can be made to trigger packers or obfuscation, unorthodox behaviors etc. While this improves coverage the end result is that you can have multiple, unrelated malware samples detected under the same name. This makes it harder to identify which specific malware you are facing. Microsoft usually does a good job of detecting samples with their specific name so I usually look at their detection name first.
In the example you give all the names are generic : Obfuscated_A probably triggers on obfuscated code, WS.Reputation.1 is most likely based on file reputation and Malware-Cryptor.General.2 probably detects a packer.
I want to add that the malware gets named after what is detected within. For example MyDoom
Schmugar chose the name after noticing the text "mydom" within a line of the program's code. He noted: "It was evident early on that this would be very big. I thought having 'doom' in the name would be appropriate." (Source: Wikipedia)
And Flamer had a lot of functions named "Flame" in it's program code. While I was working at an anti-virus company I always had a great fun with the naming practice. The reason for the names is to make sure you are talking about the same malware (md5 hashes talk really difficult). Also to decorate the families (malware that is 'just' a bit different but mainly the same). This is why you get Conficker.A and Conficker.B (like @JasonGeffer said) . The reason Microsoft's B is Sophos A is because Microsoft found a different sample of the family first in its honeypots :)
Generally Antivirus companies follow the naming convention proposed by CARO (Computer Antivirus Research Organization).
A malware usually gets a name based on the strings found in it. In some cases based on Mutex/ file name/server name/registry keys and very rarely based on its action.
In some AV companies they give certain names to track the detections made by generic/ heuristic detection methods (eg:Obfuscated_A, WS.Reputation.1)