Dark Avenger - Viruses

Viruses

Dark Avenger's first virus appeared in early 1989 and contained the string "This program was written in the city of Sofia (C) 1988-89 Dark Avenger". Thus, this first virus is usually referred to as "Dark Avenger", eponymous to its author.

It was very infectious: if the virus was active in memory opening or just copying an executable file was sufficient to infect it. Additionally, the virus also destroyed data, by overwriting a random sector of the disk at every 16th run of an infected program, progressively corrupting files and directories on the disk. Corrupted files contained the string "Eddie lives... somewhere in time!"—possibly a reference to Iron Maiden's album, "Somewhere in Time". Due to its highly-infectious nature, the virus spread world-wide, reaching Western Europe, the USSR, the United States, and even East Asia. It even received moderate mention in the New York Times and Washington Post.

This virus was soon followed by others, each employing a new clever trick. Dark Avenger is believed to have authored the following viruses: Dark Avenger, V2000 (two variants), V2100 (two variants), 651, Diamond (two variants), Nomenklatura, 512 (six variants), 800, 1226, Proud, Evil, Phoenix, Anthrax, Leech. As a major means for spreading the source code of his viruses, Dark Avenger used the then popular bulletin board systems. In its variants, the virus also contained the following strings:

• "Zopy (sic) me - I want to travel"
• "Only the Good die young..."
• "Copyright (C) 1989 by Vesselin Bontchev"

In technical terms, the most prominent feature of some of Dark Avenger's viruses was their polymorphic engine, the Mutation Engine (MtE); MtE could be linked to the plain virus in order to generate polymorphic decryptors. Dark Avenger did not, however, invent polymorphism itself, since this had already been predicted by Fred Cohen, and later put into practice by Mark Washburn in his 1260 virus, in 1990. It wasn't until a year or more later that Dark Avenger's viruses began to employ polymorphic code.

Dark Avenger made frequent attacks on Bulgarian anti-virus researcher Vesselin Bontchev. Such is the case with the viruses V2000 and V2100, which claim to be written by Vesselin Bontchev, in an attempt to cause defamation. This "conflict" between the two has led many to believe that Bontchev and Dark Avenger were intentionally "promoting" each other, or that they might even be the same person.

Dark Avenger's actions were not treated as a crime at that time in Bulgaria, since there was no law for information protection.