In the September 26 feed, an article from Habr about Soviet PCs popped up — the sixth part of a series, about imported machines that ended up in enthusiasts' hands. Among them was the Bulgarian "Pravetz 8D": an Apple II clone assembled at a plant in General Secretary Zhivkov's home village. People had written about Soviet mainframes, ES EVM, and IBM clones before, but not about Pravetz.
It turned out Pravetz is the entry point into a story I'd been avoiding. The same copying regime that gave Bulgaria a school of strong engineers also spawned the largest wave of computer viruses in the late eighties. Their authors weren't prosecuted because software laws didn't exist: infecting someone else's computer wasn't a crime, since it wasn't considered someone else's property.
And this wave has a main character who still hasn't been found. His tool, released in 1991, turned writing polymorphic viruses from a craft into a finished product with documentation — and forced the antivirus industry to completely change its operating method. That's what this text is about.
In 1967 the Politburo launched the first five-year plan for computer science. The logic was simple: don't buy hardware from the West, produce your own — by copying. The ZIT complex emerged (in Russian — "computing equipment factory"), uniting academia and industry: universities prepared graduates who in special research institutes disassembled American machines down to individual chips and instructions, and factories then reproduced them from local materials. By 1972 the cycle was working, and clones were flowing to COMECON countries — up to 180 mainframes per year.
With microcomputers the story went differently. First they were dismissed as toys for children and refused reproduction, only catching on in the mid-seventies. Then a small company trying to climb the planning hierarchy approached the Ministry of Education with a proposal: buy thousands of micromachines and put them in schools. That's how Pravetz started in 1982 — a machine assembled from copied Apple IIe components. The plant director proudly remembered two things: that his workers managed to produce half the 6502 chips themselves, and that the other half was legally purchased in Singapore, while their own chip cost twice as much as the imported one — central planning had to be circumvented.
At its peak Bulgaria supplied 40 percent of all Eastern Bloc computers, electronics generated 8 billion rubles (about $13.3 billion) per year and 300,000 jobs, and the IT sector reached 14 percent of the country's GDP. The skill of disassembling others' work and reproducing it exactly wasn't a hobby here, but a profession provided by the state.
In April 1988 Bulgaria's only computer magazine "Kompyutǎr za Vas" printed a translation of an article from the German Chip — about computer viruses and methods for writing them. A few months later real viruses arrived in the country from outside, and two people brought an infected diskette with their own "antivirus" to the editorial office. It turned out to be Vienna.
Then came the material everyone cited later. In the January 1989 issue, 29-year-old Vesselin Bontchev from the Institute of Technical Cybernetics and Robotics published an article "The Truth About Computer Viruses." His thesis: fear of viruses is turning into "mass psychosis", and any competent programmer can spot an infected file immediately — it's larger, runs slower, plays melodies, draws Christmas trees on the screen. He wrote this never having seen a virus, and later admitted the mistake: he didn't account for the secretary who uses the machine like a typewriter, or that computers in Bulgaria were most often shared.
The first homegrown virus was Old Yankee — the one that infected already-executing EXE files and played "Yankee Doodle." Its author distributed the source code to anyone interested, quickly lost interest in the subject, and moved into signal processing. Next appeared an author with about fifty versions of his own viruses, who deliberately monitored to ensure nothing got destroyed: he first wrote an antivirus, then a virus bypassing that antivirus, then a new antivirus.
And in spring 1989, the first version of a new virus contained the line: "This program was written in the city of Sofia (C) 1988–89 Dark Avenger".
The mechanics of this virus were unpleasant in themselves. It infected a file the moment the file was opened or copied — meaning you just had to run an antivirus without booting from a clean disk for everything to get infected. Nothing like it existed in nature before; now they're called fast infectors.
The destruction was cleverer. Every sixteenth execution of an infected program overwrote a random disk sector with the first 512 bytes of the virus body. Bontchev explained why this was worse than formatting: the damage is invisible, files and directories crumble gradually, and by the time the user finally notices the loss, backups already contain corrupted data. Infected files carried a marker — "Eddie lives… somewhere in time!", a reference to Iron Maiden's mascot.
Next — numbers that together explain why in the early nineties Bulgaria was a household name. John McAfee, head of the relevant association, estimated: of sixty calls per week, ten percent were about Bulgarian viruses, and 99 percent of those were about Dark Avenger. The National Computer Security Association in 1992 counted 76 Bulgarian viruses out of 318 whose origin could be established at all. By 1991, 160 documented Bulgarian viruses roamed in the wild, and a survey of six hundred major North American companies showed growth in the number of outbreaks experienced from 9 to 63 percent in nine months.
The infection reached absurd levels. In October 1990 a virus was discovered in the House of Commons library in Westminster: some files disappeared, some corrupted, and the scanner found nothing — but the corrupted files grew noticeably in size. Among the garbage characters one word was readable: NOMENKLATURA. Dutch writer Harry Mulisch caught a virus on his laptop while working on a novel, considered it a "favorable sign from higher powers" and briefly thought about naming his son Eduard — after the virus string.
Until 1991 a polymorphic virus was custom work: to change your own signature with each infection, you had to write your own generator of encrypting inserts and understand what you were doing. In 1991 Dark Avenger uploaded to Bulgarian BBSes Mutation Engine — an object module just over two kilobytes in size that linked to any virus.
The archive came with connection instructions, a demonstration virus Dedicated, a pseudorandom number generator, and a phone number for technical support. No one answered when you called, of course. The module's purpose: the virus gained the ability to encrypt its body each time with a new key and each time in a new way. Documentation for a later imitator engine formulated the license briefly: "including this engine in viruses is permitted."
The industry's response turned out more interesting than the engine itself. In June 1992 a research group from Baltimore released a public report: normal signatures don't work here because there are too many variations, and an algorithmic method is needed — searching for characteristic decryptor constructions. The report provided generation statistics: about 93 percent of mutations belong to one type, one and a half percent to another, another 5.5 percent come out as plain text because the machine randomly substituted a zero key. The public detector showed 100 percent detection, but the authors explicitly warned they knew at least two ways to make the engine unpredictable and wouldn't discuss them. Tests ran on a 40 MHz 386 and a 4.77 MHz machine with a 30-megabyte disk; for the sample set they deliberately generated decoy programs and infected them.
From this point antivirus programs stopped being collections of search strings and began turning into code analyzers. Later the engine entered at least 33 viruses, and the technique itself — a mutation generator as a package — became an industry standard for years.
A separate line in the whole story — the relationship between two people who never met. Bontchev dissected Dark Avenger's code in his magazine and called him sloppy, pointing out errors: the entire rest of the virus world considered the author a deity, while the Bulgarian antivirus researcher saw a self-taught amateur. The response came as the string "Copyright (C) 1989 by Vesselin Bontchev" embedded in the virus body. The next version, a.k.a. Eddie.2000, searched files for Bontchev's name as a sign of a working antivirus and in response to a find would hang the machine.
Then rumors started that Dark Avenger and Bontchev were one person, and the second was his network "puppet master." From Bontchev's side came public taunts, from Dark Avenger's — "affection" instead of a name, and mutual dependence: one needed an opponent for glory, the other an enemy for reputation and contracts. The funniest thing about this pair is that Bontchev gave it the name: the hero himself claimed in correspondence he didn't use a pseudonym until he was called that, and that the line about Sofia came from some old song, not from Iron Maiden as journalists decided.
Bontchev tried to track him down seriously. He gave a lecture in Sofia with the thesis that "Number of the Beast" and "Eddie" couldn't have been written by one person — different style — and waited for the author to come object. The author didn't come, but sent a letter dissecting the lecture's logic and reproaching Bontchev for making money hunting virus writers. From the letter the researcher assembled a psychological profile, sent it to seven former Sofia University students asking if they knew such a person, and all seven named the same name — a young programmer from a small private software firm. He did nothing further. The public explanation sounded like this: no point, writing viruses in Bulgaria isn't illegal.
American researcher Sarah Gordon reached him differently. She asked in a forum for a virus to be named after her — and received a demonstration virus with the engine dedicated "To Sarah Gordon, who wanted to have a virus named after her." After six months of correspondence conducted through intermediaries and in Bulgarian, she got an interview: five months of messages from which he had the right to delete any uncomfortable part. Her conclusion: this isn't Bontchev, not a maniac and not a "technopath," but someone quite unlike other virus writers.
In the correspondence itself he admits he embedded destructive code in the first virus and regrets it, explaining simply: he didn't know what else to put in it and wanted people to get rid of the infection rather than live with it. Then places begin that can't be reconciled. About responsibility for others' losses: "innocent users would have suffered much less if they bought software instead of stealing it." About antiviruses: they exist so users will "empty their wallets." About fame: he liked seeing his name in magazines, and most of all — discovering his creations inside Western antivirus programs. And there the most human thing: "the idea of a program that travels by itself and gets where its author will never get. The American government can forbid me entry but can't forbid my virus entry."
Yet the widely quoted phrase about "destroying data is a pleasure" is known only from Bontchev's words and isn't confirmed by anything in the interview, where the same person says destroying others' property is wrong. I don't know what to do with this discrepancy: possibly we're seeing two different masks of one author, possibly the quote was ripped from the context of a conversation where he was insulted first. Leaving as is.
The story's ending is dry. By 1993 Bulgaria stopped being a significant source of new viruses, and criminal liability for introducing a virus into a computer appeared there only on September 13, 2002 — a fine up to 3000 leva under new article 319d. Fourteen years between the first "Eddie lives" and the first fine — and that's perhaps the most telling interval in the entire story.
And Pravetz's children scattered in different directions. Some, like the virus author, remained unknown; others built internet providers and software companies — the Telerik founder who started with BASIC on a Pravetz-8M at age nine sold his firm for $262 million. The software industry now provides about 4.9 percent of the country's GDP. In 1997 a reporter who came to Sofia searching for Dark Avenger reached that very school room № 28 where all this life once simmered: the corridor was empty, and four boys were kicking a coin around.
Dark Avenger has not been found to this day.