Vesselin Bontchev

Background

Vesselin Vladimirov Bontchev is a Bulgarian computer scientist who became one of the most prominent virus researchers of the early antivirus era. He earned an M.Sc. in computer science, specializing in systems programming, from the Technical University of Sofia in 1985. He initially worked on expert systems at the Bulgarian Academy of Sciences before shifting his focus to the emerging problem of computer viruses in 1988, at a time when self-replicating malicious code on personal computers was still a novel and poorly understood phenomenon.

Director of the Laboratory of Computer Virology

By 1990, Bontchev headed the Laboratory of Computer Virology at the Bulgarian Academy of Sciences in Sofia. In this role he had close, direct exposure to a wave of virus creation coming out of Bulgaria, which by 1991 had become one of the world's most productive sources of new computer viruses; contemporary reporting credited Bulgarian authors with dozens of the few hundred viruses known at the time. Bontchev used his position to study, catalog, and disassemble these viruses, and to interview or otherwise gather information on the programmers producing them, publishing his findings in technical papers such as "The Bulgarian and Soviet Virus Factories." In these writings he described a domestic environment of unemployed or underpaid programmers, widespread software piracy, weak copyright enforcement, and bulletin-board systems such as the Virus eXchange BBS that freely distributed live virus samples and source code, which together he argued had fostered an unusually large and technically active virus-writing subculture.

Documenting Dark Avenger

Among the Bulgarian virus authors Bontchev studied most closely was a pseudonymous programmer known as Dark Avenger, whose viruses first appeared in 1989 and went on to become some of the most destructive and technically influential of the era, including the Mutation Engine (MtE), a toolkit released in 1992 that let other virus writers add polymorphic, self-mutating code to their own creations. Bontchev characterized Dark Avenger in interviews as a "techno-path" driven by a desire to destroy data rather than by mischief or profit, quoting the virus author's own stated view that "destroying data is a pleasure." Bontchev said he had by 1993 deduced Dark Avenger's real identity, but declined to pursue or publicize it, in part because writing viruses was not itself illegal in Bulgaria at the time. Dark Avenger's identity has never been publicly confirmed.

A public rivalry

The relationship between the two men became personal and adversarial. Dark Avenger wrote viruses, including ones known as V2000 and V2100, that falsely embedded Bontchev's name as their claimed author, an apparent attempt to discredit or implicate him. Bontchev publicly denied any involvement in writing viruses, and the episode fueled speculation in the press and among researchers about the two men's relationship, though no evidence has substantiated any claim that they were connected beyond Bontchev's role as an investigator.

Later career

From 1991 to 1995, Bontchev conducted doctoral research at the Virus Test Center of the University of Hamburg, completing a Ph.D. thesis on computer viruses. He subsequently spent sixteen years, from 1995 to 2011, as an antivirus researcher at FRISK Software International in Iceland, the maker of the F-PROT antivirus package, where his work included research into macro viruses. He also served as Bulgaria's representative to IFIP Technical Committee 11 (Computers and Security) beginning in 1990, and co-founded both the Computer Antivirus Research Organization (CARO) and the Virus Security Institute (VSI), organizations that helped formalize cooperation and shared terminology among antivirus researchers. He later returned to Bulgaria to work again at the National Laboratory of Computer Virology in Sofia.

Legacy

Bontchev's work stands as an early and unusually granular record of how a national virus-writing scene formed, operated, and interacted with the researchers trying to contain it. His papers on the Bulgarian virus factories are frequently cited by later historians and journalists writing about the origins of Dark Avenger and the broader early-1990s virus scene, and his career reflects the transition of antivirus research from an ad hoc, individual pursuit into an organized professional discipline.

Timeline

• 1985Bontchev earns an M.Sc. in computer science from the Technical University of Sofia.
• 1988Bontchev shifts his research focus to computer viruses.
• 1989The virus writer later known as Dark Avenger releases his first viruses in Sofia, Bulgaria.
• 1990Bontchev becomes director of the Laboratory of Computer Virology at the Bulgarian Academy of Sciences and begins representing Bulgaria on IFIP TC-11.
• 1991Bontchev publishes 'The Bulgarian and Soviet Virus Factories,' documenting Bulgaria's virus-writing scene, and begins doctoral research at the University of Hamburg's Virus Test Center.
• 1992Dark Avenger releases the Mutation Engine (MtE); Bontchev is quoted in international press analyzing the Bulgarian virus scene and Dark Avenger's motives.
• 1993Bontchev states he has deduced Dark Avenger's real identity but chooses not to pursue or reveal it.
• 1995Bontchev completes his Ph.D. and joins FRISK Software International in Iceland as an antivirus researcher working on F-PROT.
• 2011Bontchev leaves FRISK Software International after sixteen years.