Nomenklatura's attack on the House of Commons library had zapped data in the statistical section, rendering valuable information irrecoverable. From the House of Commons, the virus began to journey through other sectors of the British government, presumably carried on diskettes from the library. The virus traveled slowly, popping up first in one department, then spreading to another.
As soon as it was wiped out in one office, it would reappear elsewhere; it has not been completely eradicated to this day. Alan Solomon, a computer security specialist who worked on the case, is convinced that Nomenklatura's creator is the Dark Avenger.
In November 1988 stories about Robert Morris, Jr., and the Internet Worm were published in Bulgaria. The news, already exaggerated in the American press, became even more fanciful by the time it was retold in Bulgarian newspapers.
The worm excited the curiosity of two young men, Teodor Prevalsky and Vesselin (Vesko) Bontchev. They had been close friends for many years, had gone to university together, and had served side by side as officers in the Bulgarian army. Aged twentyseven, they were both engineering graduates from professional families, which made them part of the privileged class in Bulgaria at the time.
The Bulgarian computer industry was in full swing by then, but the country had few uses for the new machines. In response, a magazine was started called Komputar za vas ("Computer for You"), to show readers how to do something constructive on their relatively worthless PCs. The magazine needed technical writers who could explain how the machines worked, and Vesko, provided with desk space at the magazine's offices, found that he could double his income of $45 a month by writing the articles. By Bulgarian standards his salary was already high; with the additional income from the magazine he was positively wealthy.
When news of the Internet Worm broke, Vesko and his friend Teodor discussed it at length. For Vesko, it would be the inspiration for an article; for Teodor, it was the catalyst for a new intelectual pursuit.
On November 10, 1988, Teodor sat down at a computer at the technical institute where he worked and started to write his first virus. He had managed to get a copy of Vienna, which had been copied from Ralf Burger's book, and he used it as a model for his own bug. On November 12th Teodor proudly made an entry in his diary: "Version 0 lives."
Version 0 was, in all probability, the first homegrown Bulgarian virus. It did very little except replicate, leaving copies of itself on what are called COM files--simple program files of limited length, used for basic computer utilities. When the virus infected a file, it beeped.
Just two days after writing Version 0, Teodor had prepared Version 2.4 It was more clever than the original in that it could infect both common types of executable files: COM and EXE. The latter are the more sophisticated programs-- like word-processing, for instance--and because they are structurally complex they are more difficult to infect. But Teodor's Version 2 employed a little trick that would convert the shorter EXE files into COM files. When the operator called up, or loaded, an EXE file, the lurking virus saw the load command, jumped in ahead and modified the structure of the EXE file so it resembled a COM file. The next time a restructured EXE file was loaded up, it could be successfully infected by the virus, just like an ordinary COM file.
Teodor was also experimenting with anti-virus software at the time, and developed a program that would hunt down and kill Versions 0 and 2. It was called "Vacsina," the Bulgarian word for vaccine. However, by Version 5 Teodor had adapted his virus so that it was immune to his own killer program. He accomplished this by simply adding the character string "Vacsina" to the virus.
When his anti-virus program saw the string, it would leave the bug alone.
It was shortly thereafter that Version 5 escaped. Like most Bulgarians, Teodor had to share his computer with colleagues at the Technical Institute; with four people using one machine, with software copying rampant, and with the casual transfer of diskettes, it was only a matter of time before one of the bugs began to propagate out of his control. Within weeks Version 5 had spread throughout Bulgaria. In less than a year it had reached the West--the first Eastern virus to jump the Iron Curtain. When the virus was examined, researchers discovered the text string "Vacsina," which immediately gave a name to Version 5.
