📸

THE BULGARIAN THREAT

file. So his little bug would get to the screen first, to taunt the operator with 'Find Me!' messages. If the operator looked at his list of files he might notice that he had an extra COM file with the same name as one of his EXE files, but generally he wouldn't realize the significance. Even if he did, the bug would probably be one step ahead of him. From time to time, Find Me! would create new COM files (always with the same names as EXE files) and transfer to a new home, deleting the old one as it did so. In that way it continued to hop around the hard disk, usually well ahead of the increasingly irritated operator. It was possible to remove the bug completely, but it invariably took a few man hours of frustrating chasing.

Teodor also experimented with 'stealth' viruses — silent, deadly and almost undetectable bugs that evade anti-virus software. Stealth technology had been exploited by virus writers since 1986 (as mentioned, the Pakistani Brain virus has some stealth capability), but Teodor's was the first that could add itself to a program file without, apparently, increasing the length of the file. It was, of course, illusion: the virus would simply deduct its own length from the infected file whenever it was being examined.

With his stealth bug Teodor had more or less reached the pinnacle: there was little he could do to improve the programming of his latest virus except, perhaps, add a destructive payload. But, for Teodor, destruction of data or programs was never the point. He wrote viruses as an intellectual challenge. None of his viruses had ever been intentionally damaging, though he had become aware they could cause collateral losses on infected computers. He had also realized that a completely harmless virus was an impossibility. All viruses, by their mere presence on a computer, can accidentally overwrite data or cause a system to crash. And the most dangerous of all, he thought, was an undetectable virus that could spread unstoppably, causing collateral damage without the operators even being aware they were under attack.

In 1989 Teodor decided to retire from virus writing. His own career to then had, curiously, mirrored his friend Vesko's. While Teodor wrote viruses, Vesko wrote about them; as Teodor became more proficient at writing bugs, Vesko became more accomplished at analyzing them. By 1989 Vesko had become Bulgaria's most important

📸