Fandom

Malware Wiki

Eddie

1,345pages on
this wiki
Add New Page
Comments0 Share


Eddie is a virus that originated from Bulgaria. It was created by Dark Avenger. It was Dark Avenger's first virus and one of the early Bulgarian viruses to cause an epidemic.

Behavior

When executed, Eddie becomes memory resident. The virus infects .com and .exe files, not just when they are executed, but also when they are read. This could be when the files are copied, moved or scanned for their contents. It is also possible that if the scanner of an antivirus program becomes infected, it may infect any file that is scanned for viruses. The virus code is appended to the file.

After every 16th infection, the virus overwrites a random sector.

Variants

At some point, the source code for the Eddie virus was released to the Internet, giving rise to several variants. Only a few of these were created by Dark Avenger himself.

Variants by Dark Avenger

  • Eddie.V2000- This 2000-byte variant has contains the text "Copy me - I want to travel" and "(c) 1989 by Vesselin Bontchev.". One subvariant contains the typo "Zopy" instead of "Copy". Another contains the text "Only the Good die young...".
  • Eddie.V2100- This 2100-byte variant contains the text "Eddie lives", "(c) 1990 by Vesselin Bontchev" and "Eddie". If it finds a copy of the the Anthrax virus in the last sectors of the hard drive, it will place them on the partition table, essentially resurrecting the virus.

Subvariants of both of these contain slight variations on the text contained in the virus. A few contain the name "Diana P.", either in Latin characters or Cyrillic. Some of them may not have been created by Dark Avenger.

Variants Created by Others/Origin uncertain

  • Eddie.651
  • Eddie.1028
  • Eddie.1530
  • Eddie.1797
  • Eddie.1799
  • Eddie.1800.B
  • Eddie.2000.C
  • Eddie.2000.D
  • Eddie.Alexander
  • Eddie.Apa
  • Eddie.Father
  • Eddie.Jasper
  • Eddie.Jericho (Two Variants)
  • Eddie.Korea
  • Eddie.Major
  • Eddie.Oliver
  • Eddie.Psko
  • Eddie.Satan
  • Eddie.Shyster
  • Eddie.Sign
  • Eddie.Uriel
  • Eddie.VAN

Name

Dark Avenger named the virus himself. He took the name from the undead-like mascot of the british heavy metal band "Iron Maiden". Antivirus products typically name it after the creator.

Other Facts

The phrase Copy Me - I Want to Travel found in some variants of Eddie became the title of a documentary about the search for Dark Avenger.

Sources

Kaspersky Lab, Virus.DOS.Eddie.651.a.

Matthias Jaenichen. University of Hamburg Virus Test Center/Reports collected and collated by PC-Virus Index, The Dark Avenger virus. 1990.05

F-Secure Antivirus, F-Secure Virus Descriptions : Dark Avenger.

40HEX Volume 1, Issue 2, The Dark Avenger. 1991

Simple Analysis of Dark Avenger Virus

Касперский Лаб. Описания вирусов.

Patricia Hoffman. 40Hex Issue 3, Anthrax.

Ad blocker interference detected!


Wikia is a free-to-use site that makes money from advertising. We have a modified experience for viewers using ad blockers

Wikia is not accessible if you’ve made further modifications. Remove the custom ad blocker rule(s) and the page will load as expected.