Virus.DOS.Aids, also known as Aids Info Disk or PC Cyborg Trojan is a parasitic virus on DOS.

It replaces the AUTOEXEC.BAT file, which would then be used by AIDS to count the number of times the computer has been booted.

Once this boot count reaches 90, AIDS hides directories and encrypts the names of all files on drive C: (rendering the system unusable), at which time the user is asked to 'renew the license' and contact PC Cyborg Corporation for payment (which would involve sending 189 US$ to a post office box in Panama). There exists more than one version of AIDS, and at least one version does not wait to mung drive C:, but will hide directories and encrypt file names upon the first boot after AIDS is installed. The AIDS software also presented to the user an end user license agreement, some of which read:

If you install [this] on a microcomputer...
then under terms of this license you agree to pay PC Cyborg Corporation in full for the cost of leasing these programs...
In the case of your breach of this license agreement, PC Cyborg reserves the right to take legal action necessary to recover any outstanding debts payable to PC Cyborg Corporation and to use program mechanisms to ensure termination of your use...
These program mechanisms will adversely affect other program applications...
You are hereby advised of the most serious consequences of your failure to abide by the terms of this license agreement; your conscience may haunt you for the rest of your life...
and your [PC] will stop functioning normally...
You are strictly prohibited from sharing [this product] with others...

AIDS is considered to be an early example of a class of malware known as "ransomware".

There are 2 variants:

Virus.DOS.Aids.552

Virus.DOS.Aids.872

Type Virus Creator Dr. Joseph Popp Date 1989 Programming Language Assembly Platform MS-DOS File Type *DOS executable (.COM)

MZ executable (.EXE)

Alias(es) *Aids, AIDS!Trojan, Aidsinfo. A trojan, Aidsinfo. B trojan, Cyborg, Trj/AidsInfo. A, Trojan. AidsInfo.a, Trj/AidsInfo. B, Trojan. AidsInfo.b, Trojaids!Trojan, Love virus MD5 82504d3fcd448aa3dd726bc7fe2a3bab SHA-1 cdf23105e3bc4536d59575a5388487668921e3a4 SHA-256 4cfc6272cb2bc84ba11b94a0b22ca4ccee9184d122c3dc3418916ad92eb432e4 SSDEEP 12:wfg1/iTQc5Hw1mQlmF39nkuFxnmkv+A0vkD+HgT4Yh22oIdQ3n:wfG695HnQlCnVXcvKQgTn22oIdQ3

AIDS was introduced into systems through a floppy disk called the "AIDS Information Introductory Diskette", which had been mailed to a mailing list. Evolutionary biologist Dr. Joseph Popp, was identified as the author of the AIDS trojan horse and was a subscriber to this list.

Popp was eventually discovered by the British anti-virus industry and named on a New Scotland Yard arrest warrant. He was detained in Brixton Prison. Though charged with eleven counts of blackmail and clearly tied to the AIDS trojan, Popp defended himself by saying money going to the PC Cyborg Corporation was to go to AIDS research. A Harvard-trained anthropologist, Popp was actually a collaborator of the Flying Doctors, a branch of the African Medical Research Foundation (AMREF), and a consultant for the WHO in Kenya, where he had organized a conference in the new Global AIDS Program that very year. Popp had been behaving erratically since the day of his arrest during a routine baggage inspection at Amsterdam Schiphol Airport. He was declared mentally unfit to stand trial and was returned to the United States.

Jim Bates analyzed the AIDS Trojan in detail and published his findings in the Virus Bulletin.[3][4] He wrote that the AIDS Trojan did not alter the contents of any of the user's files, just their file names. He explained that once the extension and filename encryption tables are known, restoration is possible. AIDSOUT was a reliable removal program for the Trojan and the CLEARAID program recovered encrypted plaintext after the Trojan triggered. CLEARAID automatically reversed the encryption without having to contact the extortionist.

The AIDS Trojan was analyzed even further a few years later. Young and Yung pointed out the fatal weakness in malware such as the AIDS Trojan, namely, the reliance on symmetric cryptography. They showed how to use public key cryptography to implement a secure information extortion attack. They published this discovery (and expanded upon it) in a 1996 IEEE Security and Privacy paper. A cryptovirus, cryptotrojan, or cryptoworm hybrid encrypts the victim's files using the public key of the author and the victim must pay (with money, information, etc.) to obtain the needed session key. This is one of many attacks, both overt and covert, in the field known as Cryptovirology.

They search for files in current directory, and then write themselves to the end of file. Aids.552

This is an encrypted memory resident variant, which infects .EXE executable. Aids.872

This is a non-memory resident variant which infects DOS executable. The virus does not infect every file but it might corrupt them during infection. Files infected by this variant might cause a system hang or memory allocation error when run.

The following table shows the memory usage of the variants. Variant Memory usage in bytes Aids.552 1,024 Aids.872 Non-TSR

Aids.552

This variant displays a graphical effect when activated. Aids.872

When an infected program is run on the 10th day in any month, the virus hangs the system.

There is a virus having the same alias, the HLLO.AIDS, which is a file overwriting virus written in high level programming language.

Aids.872 contains the internal text string:

Aids

Archive Credits: https://malwiki.org/index.php?title=AIDS