MEME 3.05

SPECIAL TO MEME: In Search of the Dark Avenger*

By David S. Bennahum

What do you think of Bulgaria?

"I hate it."

What do you think of Vesselin Bontchev, I asked.

"He is an idiot!"

And Sarah Gordon?

"She is a nice lady."

I held the telephone close to my ear. Through the broad windows of my hotel room I stared at Mount Vitosha, the tip of its rounded peak glistening with faint traces of June snow. The city of Sofia spread out below.

What about Dark Avenger, what do you think of him?

"I do not want to talk about him. That time is gone. It is Ŝnished! I will not talk about it."

Those were his longest answers. How hard it was to speak with him, always answering "yes" or "no" to my questions. Angry, threatening to stop talking, yet staying on the phone with me. For all his fury, he would not hang up first. I did.

Todor Todorov - or Commander Tosh, as some call him. Founder of the Virus Exchange BBS. How to define him? An anarchist hacker? A virus writer who hatched some of the most destructive code known? Perhaps it's best to call him a Pravetz kid - one of thousands of Bulgarian children who, under communism in the early 1980s, grew up using a Pravetz 82 microcomputer. Made from reverse-engineered and copied Apple IIe parts, the machine had spawned a culture, and a legacy, that no one in the Bulgarian Politburo had anticipated. That's what Todorov is, a Pravetz kid, I thought to myself days after we spoke on the phone, as I walked down the hall of his old high school to Room 28.

Room 28. I've waited a long time to get here. What remnants could there be, of the time in the waning days of communism when teens, high on power, did things few grown-ups could understand, just on the other side of the locked door marked 28? Eight years ago, this room in the National Mathematics High School was a cybernetic hot zone, ground zero of an epidemic algorithm: the Bulgarian computer virus.

In 1989, the Ŝrst Bulgarian viruses appeared. By the end of the year, one called Dark Avenger had spread with enough velocity to attract media attention. At Ŝrst, just a few hesitant articles appeared, mentioning the new, particularly virulent strain. Dark Avenger secretly attached itself to MS-DOS .com and .exe Ŝles, adding 1800 bytes of code. Every sixteenth time the infected program was run, it would randomly overwrite part of the hard disk. The phrase "Eddie Lives... somewhere in time" would appear, followed by garbage characters. Embedded in the code was another message: "This program was written in the city of Sofia © 1988-89 Dark Avenger." The computer, self-destructing, would eventually crash, some precious part of its operating system missing, smothered under Dark Avenger's relentless output. Programs passed along in schools, offices, homes - from one disk to the next they carried the infection along, and in 1991, an international epidemic was diagnosed. One-hundred sixty documented Bulgarian viruses existed in the wild, and an estimated 10 percent of all infections in the United States came from Bulgaria, most commonly from the Dark Avenger. Dataquest polled 600 large North American companies and Federal agencies early that year, and reported that 9 percent had experienced computer virus outbreaks. Nine months later, it found the number had risen to 63 percent. Anecdotal stories, of companies losing millions in sales and productivity due to virus attacks, became commonplace. The press seized upon the threat. The war drums of fear beat first in Europe, closer to the epicenter. Papers carried lurid pieces describing the havoc it wreaked. The tattoo was quickly amplified in the US. "Bulgarians Linked to Computer Virus," read a headline in The New York Times. Time and The Washington Post ran similar stories.

Dark Avenger and a handful of other viruses - Michelangelo, Jerusalem, Pakistani Brain, Frodo - transformed the way people experienced computers. These plagues launched a lucrative new industry, the antivirus trade, and left in the minds of PC users a palpable fear that any file, no matter how innocuous, might carry with it a rapacious, information-destroying disease. Then, as suddenly and strangely as it appeared, the Bulgarian computer virus phenomenon evaporated. By 1993, Bulgaria was no longer a significant source of new viruses. But the damage was done. At its peak, in 1990-91, both the alarm and the reality of the Bulgarian blight had spread exponentially, from computer to computer, and mind to mind. Today, Bulgaria exists as a kind of cybernetic bogeyman, the birthplace of viruses.

A small destitute nation on the fringes of Southern Europe, a nation that, a generation earlier, had been largely agricultural - how was it possible that this land produced such fecund viruses? Perhaps the former East Germany, the Czech Republic, Hungary, or even Russia - countries long industrialized, with a history of producing mathematicians and scientists - these were likelier candidates; yet, relative to Bulgaria, these countries were an insignificant source. Confusion was understandable. In 1991, few foreigners knew that Bulgaria had, in a series of Five Year Plans approved by the Politburo, created socialism's first and only centrally planned home-computer industry.

In the late '80s, students in Bulgaria had access to more computers than their peers in any other Eastern European country. They did what young people do when they first meet machines - they played, they explored, they programmed. The Bulgarians were busy building a digital culture of their own, feasting off the fruits of Marxism-Leninism. And then, one forbidden fruit came to be known. In 1988, the Bulgarian computer-hobbyist magazine, Computer For You, founded in 1985, translated a German article about viruses into Bulgarian. It was a simple article, just an introduction to computer viruses. But it helped spread the idea. Several months later, the first pernicious homespun code appeared.

I came to Sofia looking for the source, the place where it all began, the equivalent of Patient Zero, the first incidence of digital infection in the nation. I wanted to know who had hatched it and how, what strange permutations of culture, computers, and people had met in the right mixture, their contact producing strains of viral code that spread around the world. I came to understand that Room 28 was as close as I could get to the epicenter, short of entering the mind of Dark Avenger. I came to Room 28 because Anton Ivanov told me about it.

State-owned subversion

"The original viruses came from the National Mathematics High School," Ivanov says, strung out on adrenaline, nicotine, a beer buzz hitting both of us as we sat at the dilapidated cafe in the basement of the state-owned Bulgarian Academy of Sciences. "Everybody was writing viruses at that time. This was the time when the so-called" - Ivanov's sarcasm was strong - "general computing initiative finally started to have a big influence." That initiative put thousands of computers - illegal clones of the Apple and IBM PCs, hacked, reverse-engineered and built by Bulgarian factories - into high schools. The National Mathe-matics High School received several of the Apple IIe machines. This school was one of the best. Only a small number of kids, those who excelled on a standardized exam, could enter. And Room 28 is where the computers went. Ivanov was one of the kids who hung out there. So was his schoolmate Todor Todorov.

There, amidst the Pravetz clones, Ivanov learned to program. Today, he is the system administrator for the mathematics laboratory and the laboratory of computer virology at the Academy of Sciences, where antivirus software is written. Ivanov presses down on the end of his cigarette, until the filter looks like the fins on a rocket ship, with smoke coming out the wrong end. Two of his closest friends have just left the country to work as programmers in the United States. Ivanov makes about US$20 per month, a little less than the national monthly average. His annual budget for a network of 2,000 users is roughly US$2,000, which he shares with three other research facilities. He has one assistant. Ivanov is stressed. Eight years ago, things were different. He would go to school where each day brought new adventures in Room 28. While he says he never wrote viruses, he watched Todorov, and Todorov's good friend Ivalio Peev, trade tips on how to write them. Peev would later help Todorov build his Virus Exchange BBS. Kids collected the corrupting code the way American youths collect baseball cards, swapping infected disks, and bringing new viruses to Room 28 for inspection. "The first Dark Avenger virus was a piece of junk," Ivanov says, thinking back to 1988. "And I know the two people who made the virus work." He laughs. "The things that kids do in high school," he says. I ask him if it was Todorov and Peev. Ivanov bends the fins on his rocket ship and shrugs. When I press him for an answer, he says, "Everyone was writing viruses."

Bulgaria today is a land of economic destitution. There are two classes: a thin layer of rich, many of them black marketers or members of the maŜa, and a huge mass of poor whose only internal division is their level of education. You can make US$30 a month with a PhD, or the same with no degree at all. The talents that are rewarded here have to do with survival, not necessarily creativity or intellect. After the eerily peaceful collapse of communism in 1989, not really from revolution, but rather from some sort of exhaustion, the Bulgarians elected a government made up of exsocialists. Drug running, fuel and arms smuggling to neighboring Serbia during the Balkan war - these were the new industries. The old industry to best survive was piracy. Where once Bulgaria produced thousands of Apple IIe and IBM clones, retooled factories now churn out pirated compact discs. The country produces an estimated 25 million pirated audio CDs and CD-ROMs per year. Its official GDP is 61 trillion leva (US$33.7 billion). Its unofficial GDP, including black market and mafia operations, is $120 trillion leva. The state cannot sink much further.

The group that came of age witnessing this transition is the Pravetz generation. Now in their 20s and early 30s, they are pioneering the expansion of Internet access, linking the nation - through cyberspace - to the rest of the world. There are approximately 30 ISPs and 300 host servers; an estimated 30,000 to 50,000 people have access, either through school, work, or home accounts. Two of the largest Internet service providers - Digital Systems and BIS OnLine - are run by entrepreneurs whose Ŝrst exposure to computers was hands-on hacking on the Pravetz. Young adults are forming businesses of their own, sparking a small renaissance of entrepreneurial activity, showing, by example, that there are economic alternatives to emigration or collusion with criminal enterprises.

Ivailo Lenkov, another graduate of the National Mathematics High School, and a schoolmate of Ivanov and Todorov, stands beside me as we enter Room 28. Lenkov, 26, is the President of Iris Systems, a company that manufactures software for making telephone calls through the Internet. Twelve people work for Lenkov - ten in Sofia, and two part-time in Northern California. Lenkov is a rare breed - a businessperson who actually builds something for export. Importing hardware, consumer goods - consuming foreign products - is the country's main legitimate industry. Actually selling something made here to the world outside is practically unheard of. Iris Systems has sold almost 4,000 copies of its software, and an average of 500 people a day download the demo software from the company's Web site. Lenkov speaks fluent English and tells me he earns US$300 a month. Although, he points out, his friend who works for Security Insurance Company (SIC), the leading Bulgarian mafia, makes US$4000 a month. Nevertheless, Lenkov is proud of his company and just wants to lead a "normal life," which for Lenkov means emigrating. He wants to move Iris Systems overseas, preferably to the United States.

Lenkov and Ivanov went in one direction - they took their computer skills and built something positive with them. Todor Todorov and Dark Avenger went in another, turning their skills to sinister uses. It was Todorov, with his Virus Exchange BBS, who helped spread the Dark Avenger's work. From 1990 to 1993, Todorov's BBS offered virus source code. People could read the code, learn the tricks, train themselves, play a little, maybe turn out a good virus. The catch, though, was that users had to upload new code, adding to the collection, otherwise Todorov would not grant them access. Since finding viruses that were not already in the library was fairly difficult, writing them was easier. They did not have to be good, they just had to work. Those who were let in could hang out with Dark Avenger, who was a frequent user, exchanging posts in the private message board. In this way, Todorov's BBS became infamous around the world, because it seemed to indicate an organized scene, a virtual virus university and club house. Todorov ran the BBS out of his mother's house, on Atanas Perikliev street, using a single phone line and a 2400-baud modem. They lived there together, in a nondescript modern apartment building of eight stories, stolid and grim, overlooking an intersection where five of Sofia's streets converge at odd angles. In 1993, Todorov disappeared. Rumors abounded. Some said he'd gone to study in the US. Others noticed how, that same year, Dark Avenger vanished as well. His last known virus, Commander_Bomber, was written in 1993. More rumors swirled, reinforcing a favorite theory that Todorov and Dark Avenger were one. This is what drew me to Room 28, the idea that Dark Avenger might have also been here once. All paths led back to this spot. Lenkov, short and wiry with a close-cropped brown beard and blue eyes, finds my romanticism about this strange. "But I understand," he said to me earlier in his car, driving to school, "you find this history interesting. For us, though, it is something we want to forget." Four boys run past us - they look about 14 years old - kicking a 10-leva coin between them, in a game that takes them up and down the empty hallway. Ten leva was once worth something. Today, it barely equals two-thirds of a cent. The teacher with us, Elena Maslenkova, who tells me she's taught at the school for 20 years, unlocks the door and we step inside Room 28.

The lights are off, and a sticky wind blows in through the open windows, billowing the tattered green curtains that suffuse the room in an eerie, phosphorescent glow. Along two long wooden tables sit seven imported IBM-PCs, with 386 processors. The blackboard is filled with lines of code in Pascal. The room is peaceful. Most of the students, I am told, are downstairs, taking final exams. The Pravetzes are long gone.

The teacher saw the Pravetz generation go by, and she remembers the excitement of those days. I ask her how today's students compare with those of Lenkov and Todorov's time. She looks up at me, her brown eyes shining. Where once this school received the best Bulgaria could offer, she explains, today it is woefully underfunded, a victim of economic collapse. "The children have the will to learn," she tells me, "but we do not have the ability to teach them." Teachers are emigrating to the West, others, unable to survive on their meager salaries, have quit to find work elsewhere. As she talks, the four teens from the hall approach and gather around the door. They want to come in. Is the room open? they ask. Maslenkova shakes her head no and closes the door behind us as we step back out into the hall. The boys resume kicking their coin up and down the empty hallway.

The antivirus hunters

In 1989, when Dark Avenger began writing viruses, a Bulgarian computer scientist named Vesselin Bontchev identified the author as "Dark Avenger." It wasn't difficult. The virus said as much in its code with "This program was written in the city of Sofia © 1988-89 Dark Avenger." Bontchev entered into a strange relationship with the programmer, who, like a ghost in a Russian novel, became Bontchev's doppelgänger. Dark Avenger created viruses, signing some of them "Vesselin Bontchev," and once left Bontchev an anonymous letter in his mailbox. Bontchev replied publicly in Computer For You. Readers watching this scene accused Bontchev of taunting Dark Avenger, of spurring him on by challenging him to ever higher feats of algorithmic daring. Some even went so far as to say Bontchev was Dark Avenger.

Bontchev, in turn, became something of a celebrity in the antivirus scene. In 1990, he founded the National Laboratory for Computer Virology at the Bulgarian Academy of Sciences, where Ivanov works as the system administrator. In 1991, Bontchev left for the University of Hamburg, where he wrote his PhD thesis and worked half-time in their antivirus lab. He currently lives in Iceland, where he works for Frisk Software International, an antivirus software company.

Bontchev's departure, the shutting down of Todorov's Virus Exchange BBS, and the end of any new Dark Avenger work, seemed to signal the end of this phase in history. The past four years have seen relatively little virus activity in Bulgaria, and so it was with some shock, in January 1997, that Ivanov came to work one morning to discover that someone named Dark Avenger had hacked into the computers at Sofia University, whose network was connected to the Bulgarian Academy of Sciences. He gained root access, and used their domain name server to spoof computers in the United States into thinking his parasitic machine was a trusted computer on the local network. For two days Dark Avenger had complete control of the country's largest academic network.

It was a good time to strike. Outside, in the streets of Sofia, thousands of citizens were calling for an end to the government of exsocialists and their cronies. Teetering on the edge of violence, the nation pulled back, and the governing Socialist Party agreed to early parliamentary elections. In April 1997, a new government - claiming to support democracy, the rule of law, and open markets - was elected, successfully winning majority control of the parliament. The United Democratic Forces now rules Bulgaria, and the country seems to be gingerly recovering from the former socialists and their network of associates. It appears that a government accountable to the people is finally in power.

Amidst the turmoil of political change, and the exhaustion brought on by economic collapse, the return of Dark Avenger has gone largely unnoticed. Those who have paid close attention are the members of the Pravetz generation who, as system administrators, have played a game of cat-and-mouse with Dark Avenger for six months. Ivanov is one, so is Kalin Bogatzevski, 24, who runs BIS OnLine. BIS was hacked by Dark Avenger during those same two days, and for several weeks the mysterious hacker had a BIS account, which he'd created using the login name "dav." Bogatzevski, who discovered computers in sixth grade while he was at Young Pioneer camp by the Black Sea, founded Sofia's first 24-hour BBS called XaX World, in his home in 1992. Daniel Kalchev, who runs Digital Systems, Bulgaria's largest ISP, says the recent break-ins are the only case of widespread cracking today. "This is not like the virus time, when a lot of people were interested," he says. "This Dark Avenger is working on his own."

No one is sure that this Dark Avenger is the same as the old Dark Avenger. But, in the tight network of system administrators, where many like Bogatzevski and Kalchev have known each other since the days of grassroots BBS expansion of the early '90s, the eerie synchronicity between the return of Dark Avenger and Todor Todorov has not gone unnoticed. Todorov, according to Bogatzevski, reappeared in Sofia in late December 1996, after a three-year absence. One month before Dark Avenger. Whether Todorov is the culprit, and whether the new Dark Avenger is the old one matters little. Dark Avenger, as Sarah Gordon, the American antivirus researcher who knows the "original" Dark Avenger better than anyone, points out, is easy to impersonate.

It is Sarah Gordon who, best of all, managed to strip away the Bulgarian hackers' braggadocio and hyperbole, uncovering the motivations of the virus writers. A former social worker and a foster parent, specializing in youths in crisis, Gordon compares the coders to angry, wayward adolescents. It was a virus that brought her into contact with Dark Avenger. In 1990, she bought a computer, and with it a virus called Ping_Pong.B. Curious about the infection, she logged into a discussion group through FidoNet and soon noticed an avid poster named Dark Avenger. Intrigued by the hype surrounding him and hoping to draw his attention, she commented she would like to have a virus named after her.

Months later, a strangely infectious bouquet called MtE - the Mutation Engine - found its way to Gordon. MtE was by no means plain. It could convert any virus into a "polymorphic" strain. That marked the end of one era in the evolution of viruses and the beginning of a second. Its changing nature made its detection much more difficult. Buried in the code of the demo virus that came with the engine was a card: "We dedicate this little virus to Sarah Gordon, who wanted to have a virus named after her."

She succeeded in doing what no one else had: engaging Dark Avenger. Over the next five years, they would continue their online exchange. She would conclude, in 1993, that Dark Avenger was a "unique individual," who had little in common with other virus writers. Where others are motivated by fame, fun, or power - to see their creation spread around the world - Dark Avenger seemed primarily motivated by a furious hatred of Vesselin Bontchev, whom he called the "weasel." He accused Bontchev of abetting him, and of conspiring with other virus writers, by providing source codes in the guise of antiviral research. Gordon's correspondence with Dark Avenger led to a series of articles and prominence in the antivirus scene. (See "An Interview with the Dark Avenger.") Her correspondence, though, would not last. When Dark Avenger heard his muse was to be married in 1995, he told her she would never hear from him again, and she has not.

Still, I am fascinated by Todor Todorov, and I call him on the telephone. His mother answers, and she speaks English. Todorov is not home. I want to ask him about these allegations, about the Virus Exchange. I want to hear what he thinks about Bulgaria. I want to know what he did between 1993 and today. Todorov, when I finally reach him, is impossible to interview. There is no opening, no conversation possible with the angry voice coming down the line. So I try Dark Avenger, using the email address Kalin Bogatzevski gave me. Bogatzevski, obsessed with Dark Avenger, had been tracking him as best he could, ever since he'd broken into Bogatzevski's system. I email the account Dark Avenger uses at, a freenet in Michigan, where he calls himself Vengador Obscuro, and I ask him if he is Todor Todorov. He responds:

i don't care what your three hundred thousand or three hundred million readers think. i don't care what you think either. there is a whole lot of fools on this planet and i couldn't possibly make every one of them happy, even if i wanted to - which i don't. third, what i write here is considered (by me) private e-mail, so none of it can get published or sent to other people or the like (if it does, and i find out about it, i'll be really pissed). other than that i don't care what you write.
by the way, are you always that pushy, or just when you are trying to do your job? that's what all reporters are supposed to be, i guess. but i must say i do not like it. and those tricks won't work with me anyway. i'm not one of those insecure little fucks that are dying to see their name printed on paper or wherever. and i have nothing to say to you about my 'real' identity, or anything else, at this time. you aren't going to get any information from me for free. i don't think it's in my interest to tell you anything, and as long as that is so, i can simply ignore you. don't get upset though... . i'm sure there is a whole lot of idiots (er... other people) out there, who would be glad to talk to you. or whatever.

The cloak of the Dark Avenger

Todor Zhivkov ruled Bulgaria for 35 years, until his downfall in November 1989. After seven years under house arrest, he lives with a small entourage in a villa overlooking Sofia. Eighty-six years old and largely ignored by the political spectrum, Zhivkov has outlived the great communist dictators of Eastern Europe. There are aspects of his legacy that Bulgarians still admire, mostly his desire to create a modern nation. It was Zhivkov who, among the Socialist dictators, gained a special place for his country as a supplier of high technology to the countries of Comecon, the economic network that managed trade between the USSR and its allies. At its peak, Bulgaria supplied 40 percent of the computers in the Eastern bloc. The electronics industry employed 300,000 workers, and it generated 8 billion rubles a year (US$13.3 billion), at a time when each ruble meant tangible improvements in living standards. Fueling production were thousands of scientists and engineers who, in a national effort, a kind of socialist Arpa, acquired outstanding computer skills. Researchers were trained to take systems apart, discover their inner workings, and then reproduce them - they were trained to hack. Todorov, Dark Avenger, Bogatzevski, Lenkov, Ivanov, Kalchev, Vesselin - each was an inheritor of this legacy, a child of Todor Zhivkov.

In 1967, the Politburo initiated the first of several Five Year Plans for informatics. In the first phase, from 1967 to 1972, it put in place a massive industrial complex to reverse-engineer, copy, and produce IBM mainframes and DEC minicomputers.

Known by the letters ZIT (an acronym which translates into Computer Machinery Works), the initiative unified academia and industry. Universities produced graduate students who worked in special research institutes taking apart US computers. Once a computer was reduced to its constituent bits on both a software and hardware level, industrial management designed a manufacturing process to replicate the machine. These managers, looking at indigenous resources, from iron to silicon to plastic and rubber, devised methods using local ingredients. After building a successful prototype, in conjunction with the engineers at the lab, assembly-line construction began. Soon after, clones appeared and were shipped to Comecon nations. ZIT would eventually produce 180 mainframes per year.

One young engineer with ZIT, Professor Kiril Boyanov, rose to control a laboratory of 1,200 researchers by 1989. Today, Boyanov sits behind a desk at the Bulgarian Academy of Sciences. Now in his 60s, he directs the Laboratory for Parallel and Distributed Processing, with a staff of 30. His budget comes mainly from the West, from European Union academic grants, and on his desk lie stacks of memos and documents with the European Community flag. Boyanov's son, who works in the lab as a system administrator, makes US$8 a month.

Outside, the campus looks like a scene from a science-fiction movie about the end of the earth - weeds and grass overflow, crunching the concrete, returning the paths to a state of nature, while lab-coated researchers, subsisting on microscopic salaries, poke their way through the fields from one building to another, or out to the highway where buses overflowing with commuters roll back and forth. The fare is 100 leva (about seven cents), but most just climb on and ride for free, their faces pressed upon the glass like petals waiting for the sun.

Boyanov built an enterprise under communism, mentoring hundreds in the special art of reverse-engineering. "I would take the best students and chose them to study with me for their doctorates. I was teaching them to analyze equipment and duplicate it. For instance, we would get the latest IBM logic boards, and figure out how they worked. Sometimes we would find mistakes," Boyanov smiles broadly at this, "and fix them." He is understandably proud - he worked to create a clone of the IBM 360/40 in 1970, a Cold War coup. Later, he worked on duplicating the IBM 370 and 1040 mainframe families, and the DEC PDP line of minicomputers. "In the USA, they needed tools to construct products. Here, we needed tools to deconstruct these products. We had fundamental skills in this, and we created a new breed of researcher - a person who could duplicate a machine using different materials." He emphasizes this last point. "The quality was not as good, but they worked. We built an economy on this." He pauses and looks at me from across his desk, the picture of his recently deceased mother staring at me from the frame by his side. "Was this good or bad?" he asks. It's a rhetorical question, and I wait for him to answer. "I don't know," he says, arms folded over his stomach. ZIT indirectly spawned Pravetz, the company named after the small town where Todor Zhivkov was born. When the first microcomputers appeared, in the mid-1970s, its engineers dismissed these machines as toys for children and decided not to reproduce them. In the strange ecology of socialist industry, where companies competed for state funds and licenses to control sectors of the market, competition existed, as did a bizarre form of entrepreneurship. A small company, looking to move up in the world of Five Year Plans, decided to get into the microcomputer business. Pravetz received support from the Ministry of Education, which agreed to buy thousands of these machines and put them in schools. The assembly lines built tens of thousands of microcomputers, beginning in 1982. These machines, starting with the Pravetz 82, went to schools across Bulgaria, and the socialist bloc. Even North Korea ordered several hundred, in return bartering cement through the Italian port of Trieste.

"About half our 6502 chips were built in Bulgaria, the other half we bought from Singapore," Vassil Tzarevsky, the former director of Pravetz, tells me with pride. Tzarevsky is proud of two things - that his workers had the skills to reproduce the microprocessors on their own - and that his managers were adept enough at earning hard currency that they could buy additional chips overseas, from legitimate distributors. "Our chip was twice as expensive as ones from Singapore," he tells me, "We had to evade central planning economics by selling more Bulgarian chips than was planned and using the extra cash to buy chips from Singapore." Tzarevksy smiles at the irony - building an expensive chip to get the same one cheaper.

According to Tzarevksy, children were always the primary audience. This made Pravetz unique because it explicitly had no military or security purpose. Rather, Pravetz appears as a monumental creature of whimsy, like the obscure Robotron videogame machine built by the East Germans in the early 1980s. These cultural artifacts serve as facsimiles of the originals, mutated to fit the directives of a centrally planned economy, and then hijacked by the young. It was not until my last day in Bulgaria that I managed to see a Pravetz 82. They are hard to find now, just one more piece of silicon junk, too obsolete to preserve. Maslenkova, the teacher who let me into the computer room at the National Mathematics High School, tipped me off. She told me of a repair shop - the last in Sofia - that specializes in fixing Pravetzes. Ivailo Lenkov and I head north, through Sofia, to a neighborhood by the railway station. Sofia, a city of 1.2 million people, doesn't seem to have any dangerous neighborhoods, but the Bulgarians I've met insist I am wrong. "This is a bad place," Lenkov tells me, as we near our destination. "Many Gypsies and Turkish people live here." I look out the window, low buildings crowd streets that seem the same as anywhere else - dirty and potholed. Up ahead I see a billboard: two men shake hands, the cuffs of their tailored suits ostentatiously visible, with the letters SIC - Security Insurance Corporation - running along the top of the advertisement. In Bulgaria, the mafia advertises.

A little way past the billboard, Lenkov turns left onto a cobblestone street slightly wider than an alley, drives up a steep hill, and parks in front of a nondescript yellowing building. A few tired trees spread their branches over the street. Outside, I see the Pravetz logo.

Lenkov and I climb a steep set of stairs and enter a long corridor, walking along the worn wooden floor until we come upon a man sitting at a dusty desk. He's chain smiling amidst the detritus of Bulgarian computer history - motherboards, drive cables, plastic computer casings, all covered in a thin patina of grime. The cigarette smoke pools at the ceiling an languidly settles down on everything. Thin and elegant, with a faded gray sweater that matches his hair, theis man is one of two official repairpersons, the last tow left in Sofia, who fix Pravetz 82 microcomputers. Across form him another younger man works on a PC, and a woman idly smokes on the sagging couch at the far end of the room, beneath a 1993 calendar with a photograph of a topless bathing beauty.

The man with the gray hair looks up and grins. He is working on a Pravetz 82 - the same sleek look as the original Apple IIe - except the keys have both Cyrillic and Latin letters, and the plastic casing is molded with fake wood grain. Inside exists a parallel universe of circuitry. I watch as the repairperson leans over the open processor, his cigarette dangling between his lips; he shows me how to connect the external floppy drive to the motherboard, I nod, and he closes the lid. I hand him seven US dollars, and he gives me the machine.

My Pravetz is a memeto mori, a tangible link to a fleeting point in time when the computer's own childhood, with its 64K of gloriously accesible RAM, matched that of youths like Todor Todorov, Ivailo Lenkov, Kalin Bogatzevski, and Anton Ivanov.

The Pravetz computers are inseparable from the Bulgarian virus epidemic. They were the first to show Bulgarian kids what strange new powers computers could give them. They are also part of a culture of mystery, a place that was once, literally, Byzantine.

That mystery still shrouds Bulgaria and its notorious virus writers. In Sofia Kalin Bogatzevshi is convinced Todor Todorv is Dark Avenger. Ivalio Lenkov, who's known Todorov since childhood, says Todorov is not the Dark Avenger. Todorov will not answer the question. Nor will the person who now calls himself Dark Avenger.

Even Sarah Gordon- the only outsider who knew the original Dark Avenger - is unsure. She admits she may not know. Dark Avenger is no longer a person, but a cloak: the letters in the handle "dav" to be worn by one impostor after the next.

It's a contagious idea that continues to grow. What began almost a decade ago in Bulgaria with one person, has spread, through the tendrils of cyberspace, around the world. Anyone can take this cloak, put it on, and become the Dark Avenger.

*This story originally appeared as "Heart of Darkness" in the November 1997 issue of Wired Magazine.

Subscirbe to MEME via e-mail.

Visit the MEME archive with issues 1.01 forward.

Search the MEME archive for anything you want.

MEME is published by David S. Bennahum. Duplication for non-commerical use is permitted. Contact me if you have questions. Direct comments, bugs and so on to me at