The Dark Avenger had started work on the virus known as Eddie just weeks before Teodor had sat down to write the first of what became his Vacsina-Yankee Doodle series. Teodor's virus was ready first, but the Dark Avenger's bug was much more malicious and infective. "It may be of interest to you to know that Eddie is the most widespread virus in Bulgaria. I also have information that Eddie is well known in the U.S.A., West Germany, and Russia too," the Dark Avenger once boasted.
The Dark Avenger likes to leave teasing references to his identity in his viruses. As in the Eddie virus, he sometimes "copyrights" his bugs, and often gives Sofia as the source. The text strillg DIANA P. was assumed to be a reference to his girlfriend, except that Diana isn't a particularly Bulgarian name. It's now belicved to be a reference to Diana, Princess of Wales.
The Dark Avenger also likes heavy-metal music: the other text string in his first virus, the mysterious EDDIE LIVES . . ., apparently refers to the skeletal mascot, Eddie, used by the British heavymetal group Iron Maiden in their stage act. Heavy-metal symbols and motifs run through many of the other viruses written by the Dark Avenger. A family of perhaps twenty or more viruses can be attributed to him, all technically advanced, most deliberately ma- licious, some containing text strings that use the titles of Iron Maiden tracks: "Somewhere in Time," "The Evil That Men Do," and "The Good Die Young." His viruses also mimic the posturing Satanism of heavy-metal music. His Number of the Beast virus (the name is yet another reference to an Iron Maiden song) contains the 3-byte signature "666," the mystical number believed to refer to "the beast," the Antichrist in the Book of Revelations.
Perhaps appropriately, of all the viruses attributed to the Dark Avenger, Number of the Beast is considered the most technically accomplished. A stealth virus, it exploits an obscure feature of the standard PC operating system to evade detection and hide in unused space on program files so that it doesn't change the length of the host file. Oddly, the virus doesn't have a payload, though its mere presence on a PC is likely to cause it to crash.
The Dark Avenger has produced four versions of Eddie and six versions of Number of the Beast, as well as four variants of a virus called Phoenix and four of another one known as Anthrax (the name of an American heavy-metal group). He is also generally believed to have written Nomenklatura, the virus that attacked Britain s House of Commons library, principally because the bug is technically sophisticated and vicious and employs techniques that have been seen in his other viruses. In a way, the Dark Avenger has become so well known that any particularly destructive and clever Bulgarian virus will almost automatically be attributed to him. The alternative is too dire for the computer security industry to contemplate.
The Dark Avenger's fame was evident from the response to his calls to the world's first "virus exchange" bulletin board, which was established in Sofia by twenty-year-old Todor Todorov on November 1, 1990. The idea was eventually copied by others in Britain, Italy, Sweden, Germany, the United States, and Russia, but Todorov was the first. The board describes itself as "a place for free exchange of viruses and a place where everything is permitted!"
Todorov built up a large collection of viruses after callers learned of his exchange procedures.
IF YOU WANT TO DOWNLOAD VIRUSES FROM THIS BULLETIN BOARD, JUST UPLOAD TO US AT LEAST 1 VIRUS WHICH WE DON'T ALREADY HAVE. THEN YOU WILL BE GIVEN ACCESS TO THE VIRUS AREA, WHERE YOU CAN FIND MANY LIVE VIRUSES, DOCUMENTED DISASSEMBLIES, VIRUS DESCRIPTIONS, AND ORIGINAL VIRUS SOURCE COPIES! IF YOU CANNOT UPLOAD A VIRUS, JUST ASK THE SYSOP [SYSTEM OPERATOR] AND HE WILL DECIDE IF HE WILL GIVE YOU SOME VIRUSES.
The Dark Avenger made his first call on November 28, 1990, four weeks after the bulletin board was set up. I'M GLAD TO SEE THAT THIS BOARD lS RUNNING, he wrote Todorov. I'VE UPLOADED A COUPLE OF VIRUSES TO YOU. I HOPE YOU WILL GIVE ME ACCESS TO THE VIRUS AREA. To which Todorov replied, THANK YOU FOR THE UPLOAD. YOUR SECURITY LEVEL HAS BEEN UPGRADED . . . AND YOU HAVE ACCESS TO THE VIRUS AREA NOW. IF YOU FIND ANY OTHER VIRUSES, PLEASE UPLOAD THEM HERE.
When it was learned that the Dark Avenger frequented Todorov's bulletin board, other users began leaving messages for him.
HI. DARK AVENGER! WHERE HAVE YOU LEARNED PROGRAMMING?
