Eddie

Eddie

Type	File virus
Creator	Dark Avenger
Date Discovered	1988.09
Place of Origin	Sophia, Bulgaria
Source Language	Assembly
Platform	DOS
File Type(s)	.com, .exe
Infection Length	1,800 bytes
Reported Costs

Eddie is a virus from Bulgaria created by Dark Avenger. It was Dark Avenger's first virus and one of the early Bulgarian viruses to cause an epidemic.

Table of Contents

Behavior

Variants

Variants by Dark Avenger

Variants Created by Others or Origin uncertain

Behavior

When executed, Eddie becomes memory resident. The virus infects .com and .exe files, not just when they are executed, but also when they are read. This could be when the files are copied, moved or scanned for their contents. It is also possible that if the scanner of an antivirus program becomes infected, it may infect any file that is scanned for viruses. The virus code is appended to the file.

After every 16th infection, the virus overwrites a random sector.

Variants

At some point, the source code for the Eddie virus was released to the Internet, giving rise to several variants. Only a few of these were created by Dark Avenger himself.

Variants by Dark Avenger

Eddie.V2000- This 2000-byte variant has contains the text "Copy me - I want to travel" and "(c) 1989 by Vesselin Bontchev.". One subvariant contains the typo "Zopy" instead of "Copy". Another contains the text "Only the Good die young…".
Eddie.V2100- This 2100-byte variant contains the text "Eddie lives", "(c) 1990 by Vesselin Bontchev" and "Eddie". If it finds a copy of the the Anthrax virus in the last sectors of the hard drive, it will place them on the partition table, essentially resurrecting the virus.

Subvariants of both of these contain slight variations on the text contained in the virus. A few contain the name "Diana P.", either in Latin characters or Cyrillic. Some of them may not have been created by Dark Avenger.

Variants Created by Others or Origin uncertain

Eddie.651
Eddie.1028
Eddie.1530
Eddie.1797
Eddie.1799
Eddie.1800.B
Eddie.2000.C
Eddie.2000.D
Eddie.Alexander
Eddie.Apa
Eddie.Father
Eddie.Jasper
Eddie.Jericho (Two Variants)
Eddie.Korea
Eddie.Major
Eddie.Oliver
Eddie.Psko
Eddie.Satan
Eddie.Shyster
Eddie.Sign
Eddie.Uriel
Eddie.VAN

Effects

Eddie spread well beyond Bulgaria and made Dark Avenger famous within some circles. It was known to have been the most prevalent virus in Bulgaria for a long time, and was also found in West Germany, the US and the USSR. In 1992, Sony had accidentally installed it to a Laser Library Distribution Disk.

Name

Dark Avenger named the virus himself. He took the name from the skeleton mascot of the band "Iron Maiden". Antivirus products typically name it after the creator.