This virus contains two interesting text strings:
"Eddie lives...somewhere in time"
"This program was written in the city of Sofia (C) 1988-89 Dark Avenger"
Based on the settings of your F-Secure security product, it will either automatically delete, quarantine or rename the detected program or file, or ask you for a desired action.
Find the latest advice in our Community Knowledge Base.
See the manual for your F-Secure product on the Help Center.
Submit a file or URL for further analysis.
The "Eddie" mentioned above is probably the skeleton mascot of the heavy metal band "Iron Maiden". This was the first virus reported to have originated in Bulgaria, but it was soon followed by many other.
There is only one thing unusual about this virus. It remains resident, just as many other viruses, but it will not only infect a program when it is run, but also when the program file is read. This means that a harmless program that opened each .EXE and .COM file in turn, for example to check them for infection, could easily cause an "epidemic".
The virus will infect .EXE and .COM files, adding 1800 bytes to the length. COMMAND.COM will be one of the first programs to become infected.
When an infected program is run, there is a 1-in-16 chance that the virus will trash a random disk sector.
One 2000 byte variant is known. It is also from Bulgaria, probably written by the same author as the original one. It has been improved a bit - you won't see an increase in file length when you issue a DIR command. A third variant, also by "Dark Avenger" is 2100 bytes long. It is possible that a 1028 byte variant is the earliest version of the virus, but this is not certain, but he is probably the author of a 1801 byte version as well.
Inside the 2000 byte variant one finds the following string
Copy me - I want to travel
or, in some versions
Only the Good die young...
The virus author also included the following string in the virus:
Copyright (C) 1989 by Vesselin Bontchev
Vesselin Bontchev, however, is a Bulgarian virus researcher and has nothing to do with the creation of the virus. The reason this message appears is that the virus searches for it in every program executed, and halts the computer when it is found, for example if one of his anti-virus programs is run.
Variant:Apocalypse-2, CB-1530, Milana, MIR, Outland, Ps!ko, Quest,Zeleng
The author of the virus - Dark Avenger - has distributed the source to the virus, and these variants are probably created by different authors.
Date Created: -
Date Last Modified: -