After seven hundred hours of intensive effort, the technicalf support staff felt confident they had eliminated all traces of Eddie. Their confidence was short-lived. Within a week Eddie was back. This time they lost a further one and a half days' work. (Because it is very difficult to remove all traces of a virus, 90 percent of victims suffer a recurrence within thirty days.) After the final bout of Eddie was cleared away, executives of the company tried to quantify how much the bug's visit had cost them--not that any of it would be recoverable from insurance. "We lost $500,000 of business-- really lost business, not orders deferred until we could catch up, but business that had to be done there and then or it went to a competitor," said the company's chief financial officer. "We also lost data. That cost us $20,000. But what really hurt was the lost business. If we force a customer into the hands of a competitor, he might go there again. I guess that could cost us another $500,000."
The company tried to find out how the virus had got into its machines in the first place. Sometimes disenchanted employees (or ex-employees) have been known deliberately to cause havoc on computer systems, but it seemed unlikely in this case. The company concluded that the infection was almost certainly accidental, probably introduced on a diskette brought in from outside. All they knew for certain was that some Bulgarian who called himself the Dark Avenger had cost them $1 million.
Meanwhile, across the Atlantic in England, computer operators in government offices in Whitehall and regional centers were confounded by a new virus that spread, seemingly unstoppably, from office to office and department to department.
The virus was first observed in the House of Commons library in the Palace of Westminster. In early October 1990, researchers at the library became concerned about one of their computer systems. The library operates a PC-based research service for members of Parliament, providing information, background, and documentation on subjects of concern. Part of the service uses a network of Compaq computers, and it was this system that was causing problems. Computer files that should have been available suddenly appeared to be missing, while others were corrupted or incomplete, and some of the file names were distorted.
As the days went by, the problems multiplied, and the head of computer systems at the library called in an outside specialist. A virus-detection program run on one of the affected machines came up clean, but from the way the computers were malfunctioning, the specialist was convinced that the House of Commons library had been hit by a virus. He compared the lengths of the program files on an infected machine with those on a clean computer. As expected, the programs on the infected computer were longer, which suggested the unknown virus was attaching itself to the ends of program files. A visual inspection of the virus followed, revealing one full word in the jumble of characters on the screen: NOMENKLATURA.
The word is of Russian origin, though in common use throughout Eastern Europe. It was the name given to the upper echelons of the Communist party and the high-ranking bureaucrats--the class that did well from the old system, those who had access to the special shops and the special rations, the cars and the country homes. It is a pejorative now and was almost certainly picked by the virus writer for its ironic overtones.
A copy of the virus, immediately nicknamed Nomenklatura, was sent to a British researcher, Alan Solomon, who runs a specialist computer data-recovery service from Berkhamsted, northwest of London. When he disassembled the bug, he found he was looking at one of the most destructive viruses he had ever seen.
The virus's target proved to be the FAT, the all-important File Allocation Table. With the FAT corrupted, the computer would be unable to reassemble data files in the correct order--hence the gaps in the information accessed in the House of Commons library. Solomon also noticed a string of text characters within the Nomenklatura program. It could be a message, he thought, except that the text was represented on his computer screen by a code that appeared to refer to non-English-language characters, which looked like Greek or Russian. Solomon guessed it was Bulgarian.
