📸

even evade anti-virus software. As soon as it noted the presence of a detection program, it would detach itself from the infected file and hide elsewhere in the computer's memory.

With Version 42, which appeared in March, his virus took on a new role: virus fighter. The Ping Pong boot-sector virus, which is believed to have been created at Turin University in Italy, had now reached Bulgaria. Ping Pong (also called Bouncing Ball) was a joke virus: from time to time it simply sent a dot careering around the screen, like a ball in a squash court. Teodor's new virus could detect Ping Pong and was able to modify it in such a way that, after a time, it destroyed itself, leaving behind its corpse. He persisted with the tune 'Yankee Doodle' as his payload, but he varied the time and frequency it would play. One of his next variants was Version 44, which plays the tune every eight days at 5 p.m. This was the version destined to become the most widely travelled of all Teodor's viruses: once again, it escaped from his office machine, probably on a diskette, and spread through Bulgaria; on 30 September 1989 it was sighted in offices of the United Nations in Vienna; and from there, now known as Yankee Doodle, it travelled the world. It was this version which caused mayhem at the West Coast publishing house in July 1991.

Teodor continued to develop his virus. The last variant was Version 50, by which time it had been given the additional power to detect and destroy the Cascade bug, which had just arrived in Bulgaria from Austria. Cascade was another joke virus: it caused the letters on a computer screen to fall down and pile up in heaps at the bottom of the VDU, to an accompanying clicking noise. After it had finished its performance, a user could resume his work. Nothing was lost or damaged, though the operator's nerves could well have been frayed.

After Version 50 Teodor began to explore some of his other ideas. One was a joke virus. It hopped around a hard disk while challenging the operator to 'Find Me!' It was unusual in that it was nearly undetectable: unlike other viruses, Find Me! wouldn't infect the boot sector or a program file. It created its own home within infected systems by stealing the name of an EXE file and attributing it to a new COM file; the new COM file became its hiding place.5

It was a clever trick. Teodor knew that on computers with two files of the same name the COM file is always loaded prior to the EXE

📸