NEWS FROM THE LAB - Tuesday, September 14, 2004

Omega day Posted by Mikko @ 18:40 GMT

Yesterday was the 13th anniversary of my personal antivirus career. On 13th of September, 1991, I made my first virus analysis. Or actually, started doing it. I'm sure it took several days to finish.

Back then finding a new virus was a big thing. It's hard to imagine that nowadays, with our labs receiving dozens of samples every day. I remember starting to research this 440 byte long virus, reading through reference manuals, interrupt lists and assembly manuals. We didn't even have separate testing machines at the time, so I couldn't just run the virus and monitor what it does. I ended printing out the assembly code of the binary and going through line by line.

Eventually I figured out how the virus replicates. I also noticed the virus would print out something on Friday the 13th. Based on my analysis, it would print out one character - ASCII code 151. I looked it up, and 151 seemed to be the code for the Omega character (Ω). So I named the virus Omega, and wrote a short description for it. My name stuck, and eventually other antivirus vendors started using it. Which was cool.

Six months later we set up our first real lab with isolated test machines. So I changed the date on one of the machines to Friday the 13th and infected it with Omega. I was reliefed to see it indeed did print out the Omega character.

Nowadays we have a tradition at F-Secure that once you've been ten years at the company, you get an Omega watch...

Omega Seamaster