|
| |
AIDS 2
|
| |
AIDS II8064
|
| |
AIDS II
|
| |
AIDS-II, Aids8064, AIDS_8064, AIDS_II8064
|
| |
Virus
|
| |
DOS
|
| |
EXE to COM companion General nuisance
|
| |
1990
|
| |
Unknown
|
| |
Unknown
|
| |
WOP & PGT of DutchCrack
|
is a companion
Computer Virus , which infects
COM File s. It was first discovered in April of 1990, and is a variant of
AIDS which itself is a derivative of the
NVIR strain. Unlike other generic file infectors, AIDS II was the first known virus to employ what could be called a "corresponding file technique" of infection so that the original target
EXE file is never changed. The virus takes advantage of the
DOS feature where if a file exists in both COM and EXE form, the COM file is executed. When an "infected" file is executed, since a corresponding COM file exists, the COM file containing the viral code is executed. The virus first locates an uninfected EXE file in the current directory and creates a corresponding (or companion) COM file with the viral code. These COM files will always be 8,064
Byte s in length with a file date/time of the date/time of infection. After creating the new COM file, the virus then plays a
Melody and displays the following message:
:"Your computer is infected with ...
:`xff`x03 Aids Virus II `xff`x03
:- Signed WOP & PGT of DutchCrack -"
AIDS II then spawns to the EXE file that was attempting to be executed in the first place, and the program runs without problem. After completion of the program, control returns to the virus. The melody is played again with the following message displayed:
:"Getting used to me?
:Next time, use a Condom ....."
Since the original EXE file remains unaltered,
CRC programs cannot detect this virus having infected a system. One way to manually remove AIDS II is to check the disk for programs which have both a .EXE and .COM file, with the COM file having a length of 8,064 bytes. The COM files thus identified should be erased.
According to Symantec, AIDS II may play a melody and display the following
String :
:"Your computer is infected with AIDS VIRUS II"
The displayed text strings do not appear in the viral code.
The AIDS II virus is not to be confused with the
AIDS Trojan or the
AIDS Virus .
