MEME 3.05



SPECIAL TO MEME: In Search of the Dark Avenger*

By David S. Bennahum



What do you think of Bulgaria?

"I hate it."

What do you think of Vesselin Bontchev, I asked.

"He is an idiot!"

And Sarah Gordon?

"She is a nice lady."

I held the telephone close to my ear. Through the broad windows of my hotel room I stared at Mount Vitosha, the tip of its rounded peak glistening with faint traces of June snow. The city of Sofia spread out below.

What about Dark Avenger, what do you think of him?

"I do not want to talk about him. That time is gone. It is ̃nished! I will not talk about it."

Those were his longest answers. How hard it was to speak with him, always answering "yes" or "no" to my questions. Angry, threatening to stop talking, yet staying on the phone with me. For all his fury, he would not hang up first. I did.

Todor Todorov - or Commander Tosh, as some call him. Founder of the Virus Exchange BBS. How to define him? An anarchist hacker? A virus writer who hatched some of the most destructive code known? Perhaps it's best to call him a Pravetz kid - one of thousands of Bulgarian children who, under communism in the early 1980s, grew up using a Pravetz 82 microcomputer. Made from reverse-engineered and copied Apple IIe parts, the machine had spawned a culture, and a legacy, that no one in the Bulgarian Politburo had anticipated. That's what Todorov is, a Pravetz kid, I thought to myself days after we spoke on the phone, as I walked down the hall of his old high school to Room 28.

Room 28. I've waited a long time to get here. What remnants could there be, of the time in the waning days of communism when teens, high on power, did things few grown-ups could understand, just on the other side of the locked door marked 28? Eight years ago, this room in the National Mathematics High School was a cybernetic hot zone, ground zero of an epidemic algorithm: the Bulgarian computer virus.

In 1989, the ̃rst Bulgarian viruses appeared. By the end of the year, one called Dark Avenger had spread with enough velocity to attract media attention. At ̃rst, just a few hesitant articles appeared, mentioning the new, particularly virulent strain. Dark Avenger secretly attached itself to MS-DOS .com and .exe ̃les, adding 1800 bytes of code. Every sixteenth time the infected program was run, it would randomly overwrite part of the hard disk. The phrase "Eddie Lives... somewhere in time" would appear, followed by garbage characters. Embedded in the code was another message: "This program was written in the city of Sofia © 1988-89 Dark Avenger." The computer, self-destructing, would eventually crash, some precious part of its operating system missing, smothered under Dark Avenger's relentless output. Programs passed along in schools, offices, homes - from one disk to the next they carried the infection along, and in 1991, an international epidemic was diagnosed. One-hundred sixty documented Bulgarian viruses existed in the wild, and an estimated 10 percent of all infections in the United States came from Bulgaria, most commonly from the Dark Avenger. Dataquest polled 600 large North American companies and Federal agencies early that year, and reported that 9 percent had experienced computer virus outbreaks. Nine months later, it found the number had