Simtel MSDOS 1992 September

home *** CD-ROM | disk | FTP | other *** search

/ Simtel MSDOS 1992 September / Simtel20_Sept92.cdr / msdos / trojanpr / aidstech.arc / AIDSTECH.DOC next >

Wrap

Text File | 1989-12-23 | 84.8 KB | 1,885 lines

By Dr Alan Solomon, Barry Nielson and Simon Meldrum The authors can be contacted at the following address: Water Meadow Chesham, Bucks, HP5 1LP England Contents Summary The diskette When it is installed The trojan The software Analysis of the software Analysis of the license Analysis of the purpose How it all happened Conclusions Appendix 1 - The blue piece of paper Appendix 2 - Details of the installation Appendix 3 - How to remove it Appendix 4 - The encryption of filenames Appendix 5 - The damage routine Appendix 6 - The Share routine Appendix 7 - Messages in the AIDS program Summary On Monday, 11th December, several thousand diskettes were mailed out containing a program that purported to give you information about AIDS. These diskettes actually contained a trojan - do not install the program. If you have installed it, you must remove it - see Appendix 3 below for how. The diskette The diskette was sent out to 7,000 subscribers to the magazine PC Business World, and also to a list obtained from the WHO conference on AIDS in Stockholm in October 1988. There may be other recipients, but this has not been confirmed. The diskette arrives in a square white envelope, containing a diskette and a blue piece of paper. The label on the diskette says "AIDS Information Introductory Diskette Version 2.0", and give the following instructions: 1. Start your computer 2. Insert this diskette in drive A 3. At the C> prompt, type A:INSTALL 4. Press ENTER If you do this, it installs itself on your computer - this process is described in more detail below in appendix 2. The files on the diskette are: INSTALL.EXE Sept 28 1989 146188 bytes AIDS.EXE Aug 7 1989 172562 bytes The accompanying blue piece of paper is documented in appendix 3 When it is installed When the installation is complete, a number of new files are on your hard disk. Extensive use is made of character 255 (hexadecimal FF) which is invisible. For the purposes of this report, we shall represent it as #. The "Space" character shall be represented as ~. A file called AIDS.EXE is put on the root directory. Two hidden subdirectories are created in the root, called # and ###~### (using the notation defined above). The # subdirectory contains a readonly, hidden file called REM#.EXE. The ###~### subdirectory contains a hidden subdirectory called ##~####, which contains a hidden subdirectory called ####~##, which contains a subdirectory called ERROR~IN.THE, which contains nothing. The ####~## subdirectory also contains five files ____.~__, _.~_~, ___.~~_, _.~~_ and _.~__ (where _ is the underline character, Acsii 95, and ~ is the space character, Acsii 32). These files are all readonly and hidden. ____.~__ contains 17 bytes, and looks like it is the serial number that the trojan gives you (see description of installation), but encrypted. _.~_~ is six bytes and is a counter, counting the number of times that REM# has been run. After the first run of REM#, it is eight bytes. ___.~~_ is one byte, an end-of-file marker (Ascii 26). _.~__ is 50401 bytes long, and consists of 252-byte records, containing 250 spaces and a carriage-return, line-feed. The installation also creates a new AUTOEXEC.BAT file, consisting of: echo off C: cd\# rem# PLEASE USE THE auto.bat FILE INSTEAD OF autoexec.bat FOR CONVENIENCE # auto.bat AUTO.BAT contains: echo off rem #PLEASE USE THIS FILE JUST LIKE AN autoexec.bat FILE FOR CONVENIENCE# This is followed by "echo on", and then the lines from your original AUTOEXEC.BAT - if you didn't have an AUTOEXEC, it has: date time It also leaves a file called AUTOEXEC.BAK behind - this contains "File not found". Perhaps if there was a file on the disk with a certain name, this might contain the contents of that file. If you had a file called AUTO.BAT, it is over-written. The "important reference number" varies from installation to installation; every time the same diskette is installed, you get a different number. The trojan Every time the computer is rebooted, AUTOEXEC runs the REM# program, and the counter counts. In all the tests that we have done, it counts for precisely 90 boots. After 90 boots, it goes into the damage routine, which puts a series of messages up on the screen aimed at preventing you from switching off, and spends a very long time accessing the disk. What it is actually doing, is first encrypting the file names on the disk (see Appendix 4 for the encryption system) and then it creates a very large file on the disk, filling it up. The software The AIDS program itself starts off by asking you a series of questions about your lifestyle, including your country. The United States is not an option here - this is consistent with the license agreement's statement that the programs are not to be used there. This program does not appear to do anything untoward to the computer, but it is impossible to be certain about this. In appendix 6, we list the text that is to be found inside the program. When the questionnaire has been completed, the program gives you a risk assessment on a scale of no risk to very high risk, and makes some suggestions about how you can reduce your risk. It then offers a screen into which you can type free-form questions, and gives you answers. This phase appears to be looking for keywords, and on recognising the keywords, it presents responses - this is a very simple thing to program. The INSTALL proram becomes the REM# program once installed - it is als also the SHARE program. We have done a Dos COMP to verify this. Analysis of the software The software is a mixture of very simple, and rather complex. The AIDS program itself has features that look quite badly written - for example, the messages are repetitive, and the free-form question and answer routine looks like it picks out keywords and gives responses based on those. The REM# routine has an encryption system that uses an IF - THEN - ELSE on a character by character basis, rather than a string lookup, or an algorithm. The program is written in Basic. On the other hand, the program creates hidden subdirectories, and in order to do this in Basic, a routine written in another language must be linked in. Also, the program intercepts Ctrl-Alt-Del, and this can only be done by intercepting interrupt 9; assembler is required. So, the software is a mixture of the very simplistic, and the rather sophisticated. Perhaps this is the work of two programmers, or maybe one programmer who used routines from another source. Analysis of the license The license looks like every other software license, unless you read it very carefully. If you read it carefully, you can see the hooks. First, it tells you about the "program mechanisms" to stop you using the software. In the case of your breach of this license agreement, PC Cyborg Corporation reserves the right to take any legal action necessary to recover any outstanding debts payable to PC Cyborg Corporation and to use program mechanisms to ensure termination of your use of the programs. Then, it warns you that this will affect other programs. These program mechanisms will adversely affect other program applications on microcomputers. Then it tells you that your computer will stop working properly. You are hereby advised of the most serious consequences of your failure to abide by the terms of this license agreement; your conscience may haunt you for the rest of your life; you will owe compensation and possible damages to PC Cyborg Corporation; and your microcomputer will stop functioning normally. Warning: Do not use these programs unless you are prepared to pay for them. Earlier on in the agreement, it explains that there is a mandatory licensing fee - the programs are not free. So the subsequent demands for money - are they blackmail, or are they debt-collection? It may require a court case to decide. Analysis of the purpose What is the point of this diskette? Is it the obvious one - PC Cyborg is trying to sell software by direct mailshot, and is trying to enforce payment by people who voluntarily decide to run it, and therefore voluntarily decide to buy it? Or is it an attempt at blackmail - PC Cyborg realised that no-one would actually read the license, but that many would run the program. Or is it sabotage - some organisation wishes to inflict damage on a large number of computers? Or is it purely random - someone without rational motives? Certainly, a large sum of mony has been spent on this mail-out. At least 10,000 diskettes have been posted (cost - perhaps 10,000), and a PO Box and company have been set up, and a large amount of software development undertaken. A figure of 20,000 is probably an under-estimate. Who would want to spend this sort of money? It is difficult to take this diskette at face value. Surely, no-one would really expect that sufficiently many people would voluntarily send $189 or $378 to a PO Box in Panama. And even when the trojan is revealed, it is hard to believe that many people would send off their money, especially as the encryption of file names would appear to be easily reversible. In the light of the careful preparation of this diskette, and the large sum of money spent, it is surely not possible that the crude attempt at blackmail (if that is what it is) is the only outcome. Is it possible that we haven't heard the last from PC Cyborg? Is it possible that in several weeks time, we will get another letter which is the real ransom note? Or is this perhaps an attempt to blackmail the next magazine that they might approach - certainly a mail-out of this kind to a magazine's readers, does that magazine no good at all. so, a threat to do the same trick to another magazine might be the objective. On the other hand, is it possible that we are dealing with simple crackpots? If so, there may be no motive, and what we have seen is all there is. The only hard fact we have, is that we do not know the motive behind this mailshot, and our recommendation on how to remove the trojan is based on this fact. How it all happened In April 1989, PC Cyborg Corporation was set up in Panama City with $10,000 equity. The three directors were Kitain Mekonen, Asrat Wakjira and Fantu Mekesse. The local agent was Lucio Bernal. In October 1989, Mr E Ketema took out a month's subscription to the Business Centre in New Bond Street, London; he claimed to be an accountant. A Mr E Ketema (not necessarily the same person) asked PC Business World if he could do a mailshot to 7000 of their readers. PC Business World, in common with most magazines, rent their mailing list to anyone who meets certain conditions. Mr Ketema operated out of a rented address at a Business Centre - there is no forwarding address. Mr Ketema told the magazine that he would be sending out leaflets advertising software written in Nigeria. In fact, the AIDS diskette was sent out to this list. The sender also used a list of 3000 that came from an AIDS conference in Stockholm in October 1988, and may have used other lists (this is unconfirmed). On Tuesday, the diskettes began to arrive. Many people were made suspicious by the license, and refrained from running the software, but many others installed it. We put out a warning on the Tuesday, via CONNECT, the IBM PC User Group's conferencing system, and we also informed the police. The press picked up the story from Connect, and on Wednesday morning, there was a front-page article warning people not to install the software. The other press picked it up from that, and soon the fact of the trojan was reasonably well known. Throughout Wednesday, Thursday and Friday, the diskettes continued to arrive - most of them were intercepted by alert PC support staff, but some were delivered directly to users, and were run. On Thursday, we received our first confirmed report of the program's trojan activating. Since then, we have received reports of others. Some sources say that the trojan activates before the 90th boot-up, some even say that it activates on the first. On Thursday, Panama declared war on the US. This is almost certainly unrelated, as the trojan planning must have happened over the last several months. But it will make it more difficult to investigate the PO Box and the PC Cyborg Corporation. PC Business World have reacted in a very responsible manner, even though they are not to blame for the AIDS trojan; they have commissioned research into the effects of the diskette, and have offered affected readers a program "AIDSOUT" that removes the obvious files that the trojan installs. They agree, however, that for maximum caution, anyone who has installed the trojan should proceed as outlined in this paper. Conclusions We may never know the full story of this program - what the intentions were, and what the programs do. But it is very surprising how many people ran the trojan, and it is clear that many companies will wish to take action to ensure that nothing like this ever happens in future. Demo diskettes sent through the post may become a thing of the past, and diskettes on the front covers of magazines might be adversely affected by the fallout. Certainly, a number of companies will change their rules about what people are allowed to load onto their computers and what is not allowed, and some companies that already have firm rules will probably be taking steps to enforce them. Many companies that had previously been hit by a virus got off lightly; many PC support staff spoke to us and said that they had run it on an isolated test machine, and as a result, were making sure that no-one else ran it. One company had PC support staff at the front entrance, handing out warning leaflets as people entered in the morning. Other companies have been hit hard, with the program going into its trojan phase, and making their computers inaccessible, at least temporarily. APPENDICES Appendix 1 - The blue piece of paper The enclosed blue piece of paper says, on the front: AIDS Information - Introductory Diskette Please find enclosed a computer diskette containing health information on the disease AIDS. The information is provided in the form of an interactive computer program. It is easy to use. Here is how it works: The program provides you with information about AIDS and asks you questions You reply by choosing the most appropriate answer shown on the screen The program then provides you with a confidential report on your risk of exposure to AIDS The program provides recommendations to you, based on the life history information that you have provided, about practical steps that you can take to reduce your risk of getting AIDS. The program gives you the opportunity to make comments and ask questions that you may have about AIDS This program is designed specially to help: members of the public who are concerned about AIDS and medical professionals. Instructions This software is designed for use with IBM (R) PC/XT tm microcomputers and with all other truly compatible microcomputers. Your computer must have a hard disk drive C, MS-DOS (R) version 2.0 or higher, and a minimum of 256K RAM. First read and assent to the limited warranty and to the license agreement on the reverse. [If you use this diskette, you will have to pay the mandatory software leasing fee(s).] Then do the following: Step 1: Start your computer (with diskette drive A empty). Step 2: Once the computer is running, insert the Introductory Diskette into drive A. Step 3: At the C> prompt of your root directory type: A:INSTALL and then press ENTER. Installation proceeds automatically from that point. It takes only a few minutes. Step 4: When the installation is completed, you will be given easy-to-follow messages by the computer. Respond accordingly. Step 5: When you want to use the program, type the word AIDS at the C> prompt in the root directory, and press ENTER. On the reverse side of the blue paper it has: Limited Warranty If the diskette containing the programs is defective, PC Cyborg Corporation will replace it at no charge. This remedy is your sole remedy. These programs and documentation are provided "as is" without warranty of any kind, either express or implied, including but not limited to the implied warranties of merchantability and fitness for a particular purpose. The entire risk as to the quality and performance of the programs is with you. Should the programs prove defective, you (and not PC Cyborg Corporation or its dealers) assume the entire cost of any servicing, repair or correction. In no event will PC Cyborg Corporation be liable for any damages, including loss of profits, loss of savings, business interruption, loss of business information or other incidental, consequential, or special damages arising out of the use of or inability to use these programs, even if PC CyborgCorporation has been advised of the possibility of such damages, or for any claim by any other party. License Agreement Read this license agreement carefully. If you do not agree with the terms and conditions stated below, do not use this software, and do not break the seal (if any) on the software diskette. PC Cyborg Corporation retains the title and ownership of these programs and documentation but grants a license to you under the following conditions: You may use the programs on microcomputers, and you may copy the programs for archival purposes and for purposes specified in the programs themselves. However, you may not decompile, disassemble, or reverse engineer these programs or modify them in any way without consent from PC Cyborg Corporation. These programs are provided for your use as described above on a leased basis to you; they are not sold. You may choose one of the following types of lease (a) a lease for 365 user applications or (b) a lease for the lifetime of your hard disk drive or 60 years, whichever is the lesser. PC Cyborg Corporation may include mechanisms in the programs to limit or inhibit copying and to ensure that you abide by the terms of the license agreement and to the terms of the lease duration. There is a mandatory leasing fee for the use of these programs; they are not provided to you free of charge. The prices for "lease a" and "lease b" mentioned above are US$189 and US$378, respectively (subject to change without notice). If you install these programs on a microcomputer (by the install program or by the share program option or by any other means), then under the terms of this license you thereby agree to pay PC Cyborg Corporation in full for the cost of leasing these programs. In the case of your breach of this license agreement, PC Cyborg Corporation reserves the right to take any legal action necessary to recover any outstanding debts payable to PC Cyborg Corporation and to use program mechanisms to ensure termination of your use of the programs. These program mechanisms will adversely affect other program applications on microcomputers. You are hereby advised of the most serious consequences of your failure to abide by the terms of this license agreement; your conscience may haunt you for the rest of your life; you will owe compensation and possible damages to PC Cyborg Corporation; and your microcomputer will stop functioning normally. Warning: Do not use these programs unless you are prepared to pay for them. You are strictly prohibited from sharing these programs with others, unless: the programs are accompanied by all program documentation including this license agreement; you fully inform the recipient of the terms of this agreement; and the recipient assents to the terms of the agreement, including the mandatory payments to PC Cyborg Corporation. PC Cyborg Corporation does not authorize you to distribute or use these programs in the United States of America. If you have any doubts about your willingness or ability to meet the terms of this license agreement or if you are not prepared to pay all amounts due to PC Cyborg Corporation, then do not use these programs. No modification to this agreement shall be binding unless specifically agreed upon in writing by PC Cyborg Corporation. Programs (c) copyright PC Cyborg Corporation, 1989 Compiler runtime module (c) copyright Microsoft Corporation, 1982-1987 All Rights Reserved IBM (R) is a registered trademark of International Business Machines Corporation. PC/XT TM is a trademark of International Business Machines Corporation. Microsoft (R) and MS-DOS (R) are registered trademarks of Microsoft Corporation. Appendix 2 - Details of the installation When you run A:INSTALL.EXE, the following happens. First, it clears the screen, and puts up in a box: \\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\ ] ~ ] Installation in progress. ~ ] ~ ] Please wait. ~ ] ~ _________________________________________ Then, it puts up the following: \\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\ ] ~ ] TURN ON THE PRINTER ~ ] and then press the ENTER or RETURN key. ~ ] ~ ____________________________________________________ And when you do that, you see: Dear Customer: It is time to pay for your software lease from PC Cyborg Corporation. Complete the INVOICE and attach payment for the lease option of your choice. If you don't use the printed INVOICE, then be sure to refer to the important reference numbers below in all correspondence. In return you will receive: - a renewal software package with easy-to-follow, complete instructions; - an automatic, self-installing diskette that anyone can apply in minutes. Important reference numbers: A31565-1043251- The price of 365 user applications is US$189. The price of a lease for the lifetime of your hard disk is US$378. You must enclose a bankers draft, cashier's check or international money order payable to PC CYBORG CORPORATION for the full amount of $189 or $378 with your order. Include your name, company, address, city, state, country, zip or postal code. Mail your order to PC Cyborg Corporation, P.O. Box 87-17-44, Panama 7, Panama. Press ENTER to continue It also prints to your printer Dear Customer: It is time to pay for your software lease from PC Cyborg Corporation. Complete the INVOICE below and attach full payment for the lease option of your choice. Be certain to refer to the important reference numbers below in all correspondence. In return you will receive: - a renewal software package; - easy-to-follow, complete instructions; - an automatic, self-installing diskette; - it takes only minutes; - anyone can do it. ----------------------------------------------------------------- Important reference numbers: A31565-1043251- I am paying for my PC Cyborg Corporation software lease for 365 user applications (approximately one year) at USD189 or for the lifetime of my hard disk (max. of 60 years) at USD378. I have enclosed a bankers draft, cashier's check or international money order payable to PC CYBORG CORPORATION for the full amount of 189 or 378 US dollars. Name:_____________________________________________________________ Title:____________________________________________________________ Company:__________________________________________________________ Address:__________________________________________________________ City:_____________________________________________________________ State:____________________________________________________________ Country:__________________________________________________________ Zip or Postal Code:_______________________________________________ Mail this completed ORDER FORM with the full payment to: PC Cyborg Corporation, P.O. Box 87-17-44, Panama 7, Panama. Then the installation procedure puts on the screen: \\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\ ] ~ ] The installation is completed. ~ ] ~ ] You are now required to complete the invoice ~ ] ~ ] and send full payment for this software. ~ ] ~ ] Please do so immediately to avoid an ~ ] ~ ] inconvenient interruption of service. ~ ] ~ ] ~ ] ~ ] When you want to use the program, type AIDS at ~ ] ~ ] the C> prompt. You will not need the original ~ ] ~ ] floppy diskette again, so give it to a friend. ~ ] ~ ] Thank you. Press ENTER to return to C> prompt. ~ ] ~ _____________________________________________________ When you press ENTER, you are returned to the C prompt. Appendix 3 - How to remove it It would seem that you can disable the trojan by simple changing the AUTOEXEC so that the REM# program no longer runs, and then you could tidy up the various hidden subdirectories. We do not recommend this procedure, for the following reason. Many researchers have run the install routine, and they have all reported that no other executables on the disk are changed. Unfortunately, this negative evidence is not proof, and if you want to adopt the maximum caution in removing the trojan, you have to make the assumption that under some circumstances, it might modify another executable, in order to do damage later. We have not observed it doing this, but we cannot prove that it doesn't without a full disassembly of the trojan. Until this is done (it will take several months, at least), we would suggest that people wanting to adopt the maximum caution proceed as follows. 1. Switch off the computer 2. Put a known clean Dos diskette in drive A. 3. Switch on the computer 4. Copy any recent data onto diskettes; do not run any executables on the hard disk. 5. Low level format the disk (if you don't know how, consult your manuals). Make sure that you enter the bad track table, if any. 6. Run Fdisk to partition the disk. 7. Format the disk. Some computers combine steps 5 to 7, and some programs (such as Disk Manager) make this process easier. 8. Replace all executables from a backup made before the trojan was installed. 9. Replace the recent data that was copies at step 4. This procedure will not mean that you lose any data, but it does take longer than running a program to remove the hidden directories and other material installed on the disk. The advantage of this procedure, is that it makes certain that, if the trojan has altered any of your executables, you will not have any unpleasant surprises later. If you decide to do this procedure at a later date, it will be more of a nuisance, as you will have to go back further in time to get a pre-trojan backup. Appendix 4 - The encryption of filenames When the trojan is triggered, it encrypts most of the file names on the disk, using the Dos RENAME function. This isn't trapped by active monitor programs such as Flushot Plus. It encrypts only files which are not readonly, and only files with an extension from the list given below. The encryption system is very simple, and is as follows. Filenames are encrypted, extensions are encoded using the list below. Original Encrypted Character Character ! S # ( $ 3 % W & 7 ' (apostrophe) $ ( B ) % - (minus) 2 0 9 1 F 2 Y 3 $ 4 J 5 E 6 T 7 ) 8 M 9 - (minus) @ L A ^G (control-G) B U C _ (underline) D @ E 8 F ! G ' (apostrophe) H Q I # J D K A L P M C N 1 O R P X Q Z R H S & T 6 U G V O W K X V Y N Z I ^H (control-H) ^ _ (underline) 0 $ 4 ^G (control-G) 5 ^ ^H (control-H) The file extensions are encoded to <space><letter><letter>n The encoding is: >From To <blank> AB APP AC BAK AD BAS AF BAT AG CAT AH CMP AI CNF AJ COM AK DAT AL DB AM DBF AN DCT AO DEM AP DIR AQ DOC AR DVC AS DYN AT EXE AU FIL AV FNT AW FRM AX GLY AZ HLP BA INI BB INP BC LBR BD LOC BF MDF BG MNU BI MSG BJ NDX BK OUT BL OVL BM OVR BN PGM BO PIF BP PRD BQ PRG BR PRN BS SCR BU SET BV SK BW REC BX STY BY SYS BZ TBL CA TXT CB WK1 CC WK2 CD WKS CE XLT CF XQT CG ZBA CH DRV CI LRN CJ CAL CK FON CL SPL CM MAC CN TST CO LGO CP GRB CQ GRA CR DTA CS PAS CW OBJ CX MAP CY LST CZ LIB DA ASM DB BLD DC COB DD COD DE FOR DF FMT DG DIF DH DRW DI FLB DJ PIC DK PAT DL VFN DM GEM DN REN DO IMG DP RSC DQ MEM DR Illustration of a possible decryption routine, in BASIC 10 A$ = "!#$%&'()-0123456789@ABCDEFGHIJKLMNOPQRSTUVWXYZ^H_$^G^" 20 B$ = "S(3W7$B%29FY$JET)M-L^GU_@8!'Q#DAPC1RXZH&6GOKVNI^045^H" 30 INPUT T$ 40 O$ = "" 50 FOR COUNT = 1 TO LEN(T$) 60 O$ = O$ + MID$(A$,INSTR(B$,MID$(T$,COUNT,1)),1) 70 NEXT 80 PRINT O$ 90 END PSEUDO-CODE FOR CLEAN-UP ROUTINE findfirst / findnext <--------------<----------------+----+ | | if (dir) store current then move up it --------------+ | | | if (no more files) if (root) exit ---> *END* | | else change back ---------------+ | | | if (AIDS system file) -------------------------------+ | | if (R/O or extension other than <SP>[A/B/C/D]?) ------+ | | | look-up extension | | if (not in table) ------------------------------------+ | else replace extension | | | | replace characters in filename from cipher | | | | write: write to floppy/ies under recovered filename <-+ | (Attribute bits should be RESET) ------------------+ Appendix 5 - The damage routine After you have booted the computer 90 times (that 90 has been reported as other values elsewhere, so it could be a variable), the trojan triggers. It tries to read from drive A, and either does so, or hangs the computer. When you start up again, you get: \\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\ ] ~ ] Please wait 30 minutes during this operation. ~ ] ~ ] WARNING - do NOT turn off the computer because you will damage the files ~ ] ~ ] on the hard disk drive. You will receive more information later. ~ ] ~ ____________________________________________________________________________ The 30 changes to 29 (sometimes to 28, 27 or 26) after a while, and then you get: \\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\ Sorry for the long delay ... still processing ... please wait. * \\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\ This is left on the screen for a short while, and then you get: Please wait during this operation. Warning, do not turn off the computer while the hard disk drive is working. A flashing hard disk access light means: WAIT! This stays up for a very long time while the disk light flashes$ the program is writing the very long data file that fills up the disk. When it is finished, it puts up: \\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\ ] ~ ] Insert the software RENEWAL DISKETTE or ~ ] ~ ] the USED SHARE DISKETTE into drive A ~ ] ~ ] and then press ENTER or RETURN. ~ ] ~ ___________________________________________ The software renewal diskette is presumably the diskette that you are expecting back from Panama. We put in a blank formatted diskette, and the program replied with: \\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\ ] ~ ] The software lease for this computer has EXPIRED.~ ] If you wish to use this computer, you must renew ~ ] the software lease. ~ ] ~ ] ~ ] ~ ] For further information on the renewal procedure ~ ] and for an order form please: ~ ] ~ ] ~ ] ~ ] TURN ON THE PRINTER ~ ] and then press the ENTER or RETURN key. ~ ] ~ ____________________________________________________ It then put the following up on the screen, and then printed out the invoice again: Dear Customer: It is time to pay for your software lease from PC Cyborg Corporation. Complete the INVOICE and attach payment for the lease option of your choice. If you don't use the printed INVOICE, then be sure to refer to the important reference numbers below in all correspondence. In return you will receive: - a renewal software package with easy-to-follow, complete instructions; - an automatic, self-installing diskette that anyone can apply in minutes. Important reference numbers: A31565-1043251- The price of 365 user applications is US$189. The price of a lease for the lifetime of your hard disk is US$378. You must enclose a bankers draft, cashier's check or international money order payable to PC CYBORG CORPORATION for the full amount of $189 or $378 with your order. Include your name, company, address, city, state, country, zip or postal code. Mail your order to PC Cyborg Corporation, P.O. Box 87-17-4tl Panama 7, Panaman Press ENTER to continue After a short while, it went into the routine that we have named the SHARE routine. Appendix 6 - the Share routine The SHARE routine is an attempt to persuade you to install the trojan on another computer. It offers you another 30 applications if you follow this routine. It starts off by putting up the following on the screen: \\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\ ] ~ ] If you would like to receive an additional ~ ] ~ ] thirty applications of this software, ~ ] ~ ] you may be eligible. A useful extension ~ ] ~ ] procedure exists for that purpose. You ~ ] ~ ] meet the terms of the agreement for the extension ~ ] ~ ] by sharing software with another computer. ~ ] ~ ] Insert a blank, formatted diskette into drive A, ~ ] ~ ] and then press ENTER or RETURN. ~ ] ~ _____________________________________________________ It then writes a file called SHARE.EXE onto the diskette, and puts up another message. \\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\ ] ~ ] The SHARE DISKETTE in drive A is now ready for use. ~ ] ~ ] Please remove it. Take it to another ~ ] ~ ] computer. Turn on that computer in the usual ~ ] ~ ] way. After the computer has been booted, insert ~ ] ~ ] the SHARE DISKETTE into its drive A. Then at the ~ ] ~ ] C> prompt type A:SHARE and then press ENTER. ~ ] ~ ] A short routine will follow on that computer. ~ ] ~ ] Afterwards, return the diskette to this computer. ~ ] ~ _______________________________________________________ When you do that, the trojan is installed on another computer. While this is going on, it puts up the message: Sharing in progress After returning to the first computer, you get: You have been credited with 30 more applications. These applications will begin at the time that you renew your software lease. Renew the lease now to resume use of the computer. Press ENTER or RETURN to continue. But you don't get the promised 30 applications. Instead, whatever you do on the computer, gives you this message: WARNING! You risk destroying all of the files on drive C. The lease for a key software package has expired. Renew the lease before you attempt any further file manipulation or other use of this computer. Do not ignore this message! The program is pretending to be the Dos C> prompt, and it parses whatever you type - most things it doesn't understand. But if you type DIR, it shows you a file that consists of the original, directory, before it was encrypted. Also, the command CD works, and y you can see other subdirectories, the same way. It understands SET and VER, but it interprets SETx as SET where x can be anything. Clearly the parser goes as far as a match, then stops. If you reboot with a soft reboot (Ctrl-Alt-Del) then the reboot is faked; the floppy diskette is accessed, but not booted from. But if you hard boot from a Dos diskette, and do a dir, you see a file called CYBORG.DOC, 1327 bytes long, containing the following. If you are reading this message, then your software lease from PC Cyborg Corporation has expired. Renew the software lease before using this computer again. Warning: do not attempt to use this computer until you have renewed your software lease. Use the information below for renewal. Dear Customer: It is time to pay for your software lease from PC Cyborg Corporation. Complete the INVOICE and attach payment for the lease option of your choice. If you don't use the printed INVOICE, then be sure to refer to the important reference numbers below in all correspondence. In return you will receive: - a renewal software package with easy-to-follow, complete instructions; - an automatic, self-installing diskette that anyone can apply in minutes. Important reference numbers: A31565-1043251- The price of 365 user applications is US$189. The price of a lease for the lifetime of your hard disk is US$378. You must enclose a bankers draft, cashier's check or international money order payable to PC CYBORG CORPORATION for the full amount of $189 or $378 with your order. Include your name, company, address, city, state, country, zip or postal code. Mail your order to PC Cyborg Corporation, P.O. Box 87-17-44, Panama 7, Panama. There is also a file on the hard disk called CYBORG.EXE. This is a small EXE file - when disassembled, all it seems to do is set the DS register to the current segment, and then exit with an errorlevel of 0. But it also has some misdirection after that, as it contains the following after the code: <false end-file-marker> <The Norton Utilities cannot read this file because the FAT has been locked> This message, plus the bytes that make up the rest of CYBORG.EXE is stored in INSTALL.EXE near the end of the file as a string of bytes encoded as their decimal equivalents, and separated by commas. In the description below, we use # to denote Ascii 255, and ~ to denote a space character (Ascii 32). After the damage routine is triggered, there are several more files in the ####~##. subdirectory. The file _.~__ disappears, and files are added. The first new file is ____.~~_, which is a one-byte file containing an end-of-file marker. The second file is called __.~~_, which contains the directory of the root, and each subdirectory, before encryption. These are in a format as if someone had done a DIR and rediected the output to a file. This file could be used to decrypt the file names, although it is easier to use the table that we have prepared in appendix 4. When the file was first created, it was called ALLFILES.REC, but it is then renamed to __.~~_ The next file is called __.~_, and this contains the message that you would get if you type VER. Next comes a file called ___.~_ containing the text "IO.SYS", and another file called ___.~__ containing just an end-of-file. The next file fills up the rest of the disk; it is called ____.~_, and appears to be a database. Records are 10058 bytes long, and look like this: DATA RECORD #1 930568 749048.6 DATA RECORD #2 252774.1 51595.27 DATA RECORD #3 162639.1 994685.6 The disk is filled up by this file. There doesn't appear to be any pattern to the "data" in this file. The directories after the damage routine ----. -- -. - ---. - contains: -. - / ----. - / --. - / --. - | ---. - | --. -- | ----. - / C:\ +--- ### ### ---- ## #### ---- #### ## ---- ERROR IN.THE | +--- # \ \ \ contains: REM#.EXE CYBORG.EXE AUTOEXEC.BAT AUTO.BAT Appendix 7 - Messages in the AIDS program Program too large String Space Corrupt wp during G.C. STOP in line of module at address No Line Number in Microsoft BASIC Compiler Runtime Version 5.60 (C) Copyright Microsoft Corp. 1982 - 1987 *Break* Hit any key to return to system Syntax error RETURN without GOSUB Out of data Illegal function call Overflow Out of memory Subscript out of range Redimensioned array Division by zero Type mismatch Out of string space String formula too complex RESUME without error Device timeout Device fault Out of paper CASE ELSE expected 2FIELD overflow 3Internal error 4Bad file number 5File not found 6Bad file mode 7File already open 9Device I/O error :File already exists =Disk full >Input past end ?Bad record number @Bad file name CToo many files DDevice unavailable ECommunication buffer overflow FPermission denied GDisk not ready HDisk media error IAdvanced feature error JRename across disks KPath/file access error LPath not found Unprintable error ?Redo from start Overflow Bytes free KYBD SCRN CONS COM1 COM2 LPT1 LPT2 LPT3 *Break* You must run the INSTALL program before you can use the AIDS program. I N F O R M A T I O N AIDS Information (C) copyright PC Cyborg Corporation, 1989F Compiler runtime module (C) copyright Microsoft Corporation, 1982-1987 All Rights Reserved An interactive program for health education on the disease AIDS designed for use with IBM PC/XT computers and true compatibles requiring a hard disk drive and a minimum of 256K memory I N T R O D U C T I O N Welcome to the interactive computer program called AIDS Information. This program is designed to provide up-to-date information about you and the fatal disease AIDS (Acquired Immune Deficiency Syndrome). The health information provided to you by this program could save your life. Here is how the program works: First, the computer will ask you a series of questions about your personal background, behaviour and medical history. Then the program will calculate your chances of being infected with the AIDS virus and inform you about your present degree of risk. Then it will provide you with advice on what you can do to reduce your risk of future infection, based on the details of your own lifestyle and history. Finally, it will give you the chance to ask questions or to make comments. U S E T H I S P R O G R A M I N P R I V A T E The disease AIDS is often transmitted from person to person through sexual contact. For that reason, many of the questions and answers in the program are of a highly personal nature. For example, there are questions about the details of your sexual behaviour. So we strongly recommend that you use the program while you are alone, and not while you are in the presence of other people. When answering the questions, remember that you can be completely honest with the computer because it keeps no records of your answers and it does not ask for your name. Honest answers will allow the program to give you good, accurate advice in return. Please share the program diskette with other people so that they may benefit from it, too. You may give them the program diskette because you will not need it again now that you have installed it on your computer. But you must first read and assent to the printed limited warranty and license agreement before you may share or distribute this software. W H A T Y O U N E E D T O K N O W A B O U T A I D S The disease AIDS is caused by a virus called HIV. The virus is passed from person to person by sexual contact, by sharing blood products, and through dirty needles & syringes. At the present time there is no cure for the disease, and it is always fatal once it develops. Only people who have the AIDS virus develop the disease AIDS. But not all people who are infected by the virus have the actual disease. Instead, some carry the virus for years and appear to be healthy. However, these carriers are at risk of developing the actual disease as time passes. Also, they are able to transmit the virus to other people with whom they have sexual relations. Since there is no cure for the disease, the only means by which you can protect yourself is prevention. You can prevent being infected through safe behaviour. Minimizing the number of your sexual partners and practicing safe sex are the two best ways to reduce your chances of becoming infected. The purpose of this program is to help you understand exactly what you can do to avoid infection. Now, the program... Look at the top of this screen. You will see a list of countries. The names of the countries are in alphabetical order. Use thei RIGHT ARROW KEY on the keyboard to move the HIGHLIGHT BAR to the the name of the country in which you live. Then press ENTER to select that country. If you do not see your country above, keepe pressing the RIGHT ARROW until it appears in the list. If you go past your country, you may use the LEFT ARROW KEY to go back. All of the countries in Africa and many countries in Europe, Asia. and elsewhere are in the list, so look carefully for your country. Choose a country now, using the RIGHT ARROW or the LEFT ARROW they are the CURSOR CONTROL KEYS on the computer keyboard), and then press the ENTER KEY. B A C K G R O U N D I N F O R M A T I O N: Country: was selected Country: was selected What is your sex? was selected was selected What is your age group? was selected was selected Choose the continent of your ancestors' origins: was selected was selected Choose a description your sexual behaviour: was selected was selected Choose the number of your sex partners since 1980: was selected was selected M E D I C A L H I S T O R Y Have you received a blood transfusion since 1980? was selected was selected Do you have haemophilia (bleeding disease)? was selected was selected Do you have tuberculosis? was selected was selected Do you inject addictive drugs? was selected was selected Have you had a sexually transmitted disease since 1980? was selected was selected Do you use a condom during sexual intercourse? was selected was selected In a previous question you described your sexual behaviour as homosexual or bisexual. Please answer the additional questions below: Have you had homosexual contacts for more than five years? was selected was selected Have you been the receptive partner in anal intercourse? was selected was selected Do you use nitrates (a type of drug) during sex? was selected was selected Do you have sex with prostitutes? was selected was selected In a previous question you selected the age group of 0-3 years. Please answer the additional question below: Is the mother of this infant infected by the AIDS virus? was selected was selected In previous question you described your sexual behaviour as homosexual or bisexual, and you are a female. Please answer the additional question below: Have you had sexual intercourse with a man since 1980? was selected was selected PLEASE ANSWER THE ADDITIONAL QUESTIONS ABOUT YOUR PRESENT HEALTH BELOW: Have you had a large and unexplained weight loss recently? was selected was selected Have you had diarrhoea for many months? was selected was selected Do you have swollen glands in a number of places in your body? was selected was selected Have you had many mouth and throat infections recently? was selected was selected. Have you had a cough for more than one month? was selected was selected. Have you had a fever for more than one month? was selected was selected Do you have a generalized skin infection? was selected was selected Do you have persistent night sweats? was selected was selected Do you have severe and unexplained tiredness? was selected was selected T H E P R O G R A M I S W O R K I N G O N T H E I N F O R M A T I O N T H A T Y O U H A V E P R O V I D E D . P L E A S E W A I T . START DONE T H E C A L C U L A T I O N S A R E N O W C O M P L E T E . T H E C O M P U T E R I S R E A D Y T O G I V E Y O U A P E R S O N A L A I D S R I S K A S S E S S M E N T . SEVEN LEVELS OF AIDS RISK Extremely high risk group Very high risk group High risk groupg Medium risk groupo Low risk group Very low risk group No risk group This is your AIDS risk group Look at the list of SEVEN LEVELS OF AIDS RISK above. That list is divided into 7 risk groups. The highest risk group is at the top. The lowest is at the bottom. The group to which you belong is shown with an arrow and a box. P E R S O N A L A D V I C E After careful analysis of the information that you have provided, we offer you the following confidential advice: You are advised that your risk of contracting AIDS is so large that it goes off the chart of probabilities. Your behaviour patterns are extremely dangerous, and they will very likely kill you. You are doing a number of things that make it almost certain that you will become infected with the AIDS virus, if you don't have it already. Read the advice below carefully: This infant requires special medical attention. It is at risk because its mother may have passed the AIDS virus to it before it was born. Consult a doctor for additional information. When you grow up, avoid sex until you marry. There is no other practical advice that we can offer to young children. Good behaviour! For safety, avoid sex outside of marriage. Continue to be faithful to one sex partner because that is safe. Try to stay with one sex partner in the future for your own safety. Decrease the number of your future sex partners to only one person. Warning: Stay with one sex partner in the future. Danger: You must reduce the number of your sex partners. Danger Warning: Reduce the number of your sex partners now! Extreme Danger: You must reduce the number of your sex partners now! Get professional medical advice about your drug problem. Buy condoms today at a pharmacy when you leave your office. Always use them during sex -- never have sex without them. See a doctor immediately; you may be very ill. Reduce the number of your sex partners to avoid future infections. Stay with only one sex partner to protect yourself and others. Do these things now without delay. You have no time to waste. Do these things to save your life and for the sake of all humanity. You must use condoms when you have sex for your own safety. Using condoms is the most important thing that you can do. See a doctor immediately; you may be very ill. Reduce the number of your sex partners to avoid future infections. The more sex partners that you have, the greater your risk. You are in a very dangerous risk category. You must take some steps now to save your life. Choose your future sex partner with very great care and have only one. Always use a condom if you have sex outside of marriage. Follow this advice if you want to live. We recommend that you use condoms when you have sex for your own safety.: Using condoms is the most important thing that you can do. Consider visiting your doctor for a check up. You are in a dangerous risk category, but it is not too late for you to take steps to save your life. Choose your future sex partner with great care and have only one. Always use a condom if you have sex outside of marriage. If you ignore this advice you will be sorry. Your medium risk of exposure to the AIDS virus is unacceptable if you value your life. Take some practical steps now to reduce your risk before it is too late. Stay with one sexual partner in the future and use a condom if you have sex outside of marriage. Consider visiting your doctor for a check up. Your medium risk of exposure to the AIDS virus is unacceptable if you value your life. Take some practical steps now to reduce your risk before it is too late. Reduce the number of your sexual partners. Have only one sexual partner in the future to significantly lower your risk, and use a condom if you have sex outside of marriage. Consider visiting your doctor for a check up. Your risk of exposure to the AIDS virus is low, but considering that AIDS is a fatal disease, you should take steps to further reduce your risk. First, stay with one sexual partner in the future. Second, if you have sex outside of marriage, then use a condom. Your risk of exposure to the AIDS virus is low but it is increasing. You must now change from your past patterns of having more than one. sexual partner. If you continue to have more than one sexual partner then you will you have a much greater risk of exposure in the future. And it is very important for people in your risk group to use a condom if they have sex outside of marriage. You are like the majority of people in the world - you have a very low risk of exposure to the AIDS virus. In fact, your risk is so small that. there is not much that you can do to make it smaller. But you can do something to avoid increasing your risk in the future. Avoid sexual relations outside of marriage. Practice safe sex using a condom if you do have sex outside of marriage. Keep the number of your future sexual partners to a minimum. Insist that your sex partner be mutually faithful to the relationship. At the present time, your risk of previous exposure to the AIDS virus is very small. But you will face increasing danger in the future if you continue your pattern of having sex with more than one partner. As the AIDS virus spreads around the world, the chance that one of your sexual partners will have it increases with time. In the future, practice safe sex using a condom, if you have sex outside of marriage Reduce the number of your sexual partners. Insist that your sex partner be mutually faithful to the relationship. According to our calculations that are based on the information that you have provided, you have no measurable risk of contracting AIDS. If you are worried about having AIDS, then you may be assured that you do not need to worry. However, it is important for you to know that if your behaviour changes in the future, then your risk of getting the AIDS virus will also change. If you become sexually active in the future, then be sure to practice safe sex with one partner. Y O U R C O M M E N T S This part of the program gives you the opportunity to get more information by asking additional questions about AIDS. Use the computer like a typewriter. Type anything that comes to your mind in the space below. Then computer will then analyze your remarks and respond to you with further comments. Use English. Press ENTER TWICE when you are done typing. You do not need to press ENTER at the end of each line. Words will break into two automatically at the end of the line and the program will understand them. Press ENTER TWICE when done typing or press ESCAPE for Menu Options. Analyzing your comments, please wait. P R E P A R I N G A R E S P O N S E . . . P L E A S E W A I T AIDS QUESTION QUESTIONS THANK THANKS MEDICINE MEDICINES DRUG DRUGS CURE CURES PREVENT PREVENTION PROTECT PROTECTED HUSBAND WIFE WIVES CHILD CHILDREN BABY BABIES INFANT INFANTS SEX INTERCOURSE CONDOM CONDOMS RUBBER RUBBERS SAFE AFRICA AFRICAN AFRICANS RACIAL RACE RACES RACIST RACISTSS RACIALIST RACIALISTS PROGRAM PROGRAMS PROGRAMME PROGRAMMES COMPUTER COMPUTERS HOMOSEXUAL HOMOSEXUALS GAY GAYS LESBIAN LESBIANS BLOOD SALIVA SPIT SPITS SPITTING TEARS SEMEN PREGNANT PREGNANCY ANAL ANUS KISS KISSES KISSING CONTAGIOUS SPREAD SPREADING FOOD WATERD MOSQUITO MOSQUITOES INSECT INSECTS TOILET TOILETS SKIN HAND HANDS TUBERCULOSIS TATTOO TATTOOS TATTOOINGS CIRCUMCISE CIRCUMCISED CIRCUMCISION SCARIFICATION STERILE STERILIZE STERILIZATION STERILIZING ASEPSIS ANTISEPTIC SLIM VIRUS ANTIBODY ANTIBODIES HIV SEROPOSITIVE ARC SYMPTOM DEMENTIA BRAIN BREAST BREASTFEED BREASTFEEDING R E S P O N S E T O Y O U R C O M M E N T S You did not type any comments, so the program has no response. The program did not fully understand your comments. Would you like to type them again using different words? If so, press ESCAPE and then press R to repeat the last step. You are welcome. We are happy that you found this program useful. Scientific studies show that you can not catch AIDS from insects. Condoms are effective protection against the AIDS virus. But they can break: during intercourse. And they must be used from the very beginning of a sex fact to the end of it. Most pharmacies, drug stores, clinics and family planning organizations have condoms available in Computers can do some remarkable things. It is all a matter of good programming. Because AIDS in such a great threat to human life, we did our best to make this program usable and relevant. No, there is no know cure for the disease AIDS. Prevention is the only protection. Safe behaviour including keeping the number of sex partners small and choosing them wisely is the best course of action. There is no drug at the present time that can prevent or cure AIDS. But there are medicines that can fight the other infections that often accompany AIDS. See a doctor if you want specific advice or detailed information. You mentioned toilet. It is not possible to catch AIDS from public toilets. Furthermore, transmission of the disease through the fecal-oral routine has not been documented. Mosquitoes do not appear to be AIDS vectors. In other words, you will not get AIDS from a mosquito. The AIDS virus is easily transmitted by contaminated blood. The majority of people who receive contaminated blood during a transfusion become infected. Likewise, dirty needles and dirty syringes easily transmit the virus. But it is safe to donate your blood through the blood bank. If you need a blood transfusion yourself, it is possible to screen the blood for the AIDS virus lbefore you receive it to be sure it is safe. Ask your doctor for details. This computer program is interactive. In other words, it responds to different people in different ways, depending upon the information that they provide and the questions that they ask. Frankly, we wonder why there are not more programs like this one available for health education. Computers could be powerful weapons in mankind's fight against disease. There is only a small chance of getting the AIDS virus through saliva. Casual kissing appears to be safe. Open mouth kissing appears to be more dangerous. It is that which often follows open mouth kissing that is most risky. Food contaminated with saliva has not be shown to be a source of AIDS infections. Similarly, public spitting, although unhygienic, does not cause AIDS infections. The AIDS virus does not pass through normal skin, so casual contact between people does not spread it. For example, shaking hands with and AIDS victim is not dangerous. However, contamination of ones skin with infected blood should be avoided. Medical personnel should wear protective clothing when they expect to be exposed to blood or blood products. An infant can be infected with the AIDS virus before it is born if the mother of the infant has been infected with the virus. The chance that an unborn infant will get the virus if its mother is infected is about 50%. The AIDS virus can also be transmitted through breast milk, although the risks involved for a breast feeding infant are not well known at present. There is reasonable evidence indicating that the AIDS virus first entered the human population on the continent of Africa. Accordingly, the virus has has more time to spread among the peoples of that continent. It also appears that AIDS is rapidly becoming the most serious health threat in the region. Because it affects people most commonly in their productive years of life, social and economic costs of this disease will be very great. At the present time central African and eastern Africa are most seriously affected, with the disease reaching epidemic proportions in some major cities. However, all countries in Africa have cases of AIDS, so prevention and safe behaviour is important everywhere, including in The AIDS virus has infected different populations to different degrees. At the present people of African origins are at the greatest risk. This pattern exists for a number of reasons. First of all, people who live in Africa have been exposed to the virus for a longer period of time. Secondly, people of African origins who live in the First World may be exposed to the virus at high rates due to socio-economic and cultural reasons. And although the people of all races appear to be susceptible to the disease AIDS, there is the possibility of racial variation in susceptibility as there is with other diseases like malaria and skin cancer. The high frequency of AIDS among African people has led to some considerable controversy and to polarization on the issue. Valuable time and energy that could be used in combating the spread of the disease has been lost during unwise efforts by some to debate its origins and to deny its very existence. But regardless of your personal views about the origins of the virus, do not expose yourself to danger by denying that a serious threat exists not just for Africans but for all of humanity. AIDS can be prevented by avoiding the virus. It is transmitted by sexual contact, through blood contact, and from mother to unborn child. The best way to prevent infection by the AIDS virus is to avoid sex or to practice safe sex with one partner. Safe sex means to use a condom if you are in doubt about your partner's possible previous exposure to the AIDS virus or if you may have been previously exposed to the virus yourself. Homosexual men have a particularly large risk of exposure to the AIDS virus. This high risk follows from the means by which the virus is passed from one person to another. The virus is transmitted from an infected person to a healthy one through body fluids or through blood. Homosexual men are commonly exposed to both body fluids and to small amounts of blood during homosexual sexual behaviour. Male homosexuals who are promiscuous that means having many different sex partners) have the greatest risk of infection. Homosexual women or lesbians do not have a high risk of exposure to the AIDS virus. Bisexual women are exposed to the same risk of AIDS virus infection as other women who have sex with men. In conclusion, having unprotected sex with an infected man is dangerous for anybody. If you are a male homosexual, then always use a condom during sex. Lesbian women do not have a high risk of AIDS infection. But bisexual women face the same risks of exposure as heterosexual women. All peoples can protect themselves from AIDS infections by choosing their sex partner with great care.C The risk of AIDS infection and it's relationship to circumcision is somewhat complex. First of all, circumcision by traditional means can be dangerous because unsterile tools may be used during the actual process of circumcising. For example, the person being circumcised could be infected by the AIDS virus if the same knife was used previously on another person who was a carrier of the virus. There is another aspect of circumcision that should be mentioned here: Some evidence exists which indicates that uncircumcised men have a greater chance of infection with the AIDS virus than circumcised men do. The reasons for this pattern are not yet entirely clear. Overall, male circumcision if practiced under proper medical supervision appears to be a healthy practice. And unfortunately, traditional male and female circumcision practices without medical supervision appear dangerous in terms of AIDS virus exposure. Scarification for ritual or decorative purposes is dangerous in terms of AIDS virus transmission. This practice is almost always carried out under conditions that prevent proper sterilization of the tools. Since the tools come into contact with the blood of more that one person, they are able to transmit the virus from an AIDS carrier to an uninfected person. You mentioned semen. The AIDS virus is present in the semen of a man who has been previously infected by the virus. That man may not show any of the symptoms of the disease AIDS, but he can still transmit the disease to others. Men who think that they may be carriers of the AIDS virus must always use a condom to protect others from infection, and to protect themselves from further infection by sexually transmitted diseases. The AIDS virus may appear in small quantities in the tears of an infected person. However, exposure to tears is not likely to be a major mode of transmission of the disease. The AIDS virus can be transmitted during tattooing if dirty needles are used. Tattoo needles must be treated like surgical instruments. They must be fully sterilized before use. They must never be shared among people if they cannot be sterilized before each usage. For household use you may destroy the AIDS virus with ordinary household chlorine bleach when cleaning linen, utensils, bathrooms, etc. Do not use bleach on wounds. If you are a medical professional, then you need more information. See the World Health Organization publication entitled: WHO AIDS SERIES 2, Guidelines on Sterilization and High-Level Disinfection Methods Effective against Human Immunodeficiency Virus (HIV). It is ISBN 92 4 121002 8. If a wife and husband are mutually faithful to each other, and if neither was previously infected by the AIDS virus, then sex within marriage is very safe. However, if a husband or wife is infected with the AIDS virus, then it is likely that they will infect their spouse. Promiscuity is equally dangerous for married and unmarried people. Stay with one sexual partner and insist that your spouse does likewise. Anal intercourse for men and women is a likely means of AIDS transmission if one of the two people are infected with the AIDS virus. Anal intercourse commonly damages the lining of the intestine and causes bleeding. This injury and the associated bleeding increase the chances of infection. Condoms appear to provide some protection to both partners during anal intercourse.F AIDS is sometimes called Slim disease, particularly in eastern Africa. AIDS is a social, economic and political problem as well as a medical one. Social structures will be disrupted, economies will be burdened and health care resources will be overstretched as the number of AIDS cases increase. A virus is a very small disease-producing organism. Many human diseases including AIDS, polio and measles are caused by viruses. Those people who are infected with the HIV virus do produce antibodies, but they do not seem to be very effective against the virus. HIV means Human Immunodeficiency Virus. It is the virus that causes AIDS. When it invades the body it causes the immune system to break down. Two types of HIV have been discovered so far. Seropositive means that a person has been tested for infection with HIV, and that antibodies have been found in that person's blood. That means the person has been exposed to the virus, but it does not necessarily mean that the person has the disease AIDS. AIDS can be diagnosed by the clinical symptoms associated with the serious AIDS-related illnesses. ARC is a condition in which a person has illnesses caused by the HIV virus, but does not have the cancers and other fatal AIDS-related infections. Symptoms of AIDS include weight loss, skin tumours (like Kaposi's sarcoma), fungal infections (like Candida albicans), lung infections (like Pneumocystis carinii pneumonia) and degenerative brain disorders. AIDS can destroy brain cells, causing memory loss, confusion, personality changesl incontinence and senility. There seems to be a small chance that an infected mother can pass the AIDS virus to a breastfeeding baby. For further information consult your doctor. Children between the ages of 4 and 13 have a very low risk of AIDS infection. But younger children may have been infected before birth if their mother was an AIDS virus carrier. Older children are at risk if they become sexually active. A pregnant woman who carries the AIDS virus can pass the virus to her unborn child. The AIDS virus is not spread through causal contact in schools, workplaces or public places. It is not spread through water, food, eating utensils, coughing, sneezing, insects or toilets. You can not get the AIDS virus from food or water. Tuberculosis is a common infection among AIDS victims in Africa. Yes, the AIDS virus is commonly transmitted by sexual intercourse. The program has tried to answer your question(s). If you are not satisfied with the response, then ask the question again using different words. Please be very specific about what you want to know. If you would like to ask more questions, then press ESCAPE and then R. If you would like to end the program, then press ENTER. ...................more on next page................... (continued). Press ENTER to continue or press ESCAPE for Menu Options. Now use the DOWN ARROW or UP ARROW to select a choice, then press ENTER.. You selected HELP Press ENTER to continue or press ESCAPE for menu First read the information on the computer screen, then press the ENTER key to go on to the next step. Many nations appear in the menu at the top of the screen. Use the RIGHT and LEFT ARROW keys to move the highlight bar to your country, then press the ENTER key. You must pick one of the countries before you can go to the next question. If you are a man, then use the DOWN ARROW key to move the highlight bar to the option [ Male ] and then press ENTER. If you are a woman, then use the DOWN ARROW key to move the highlight bar to the option [ Female ] and then press ENTER. You must pick Male or Female before you can go to the next question. Pick the age group to which you belong. For example, if you are 35 years old, then move the highlight bar using thee DOWN ARROW to the option [ 30-39 years ] and then press ENTER. If you are using the program for another person such as a child, then pick the age group that is correct for that person. Pick the place from which your parents come. For example, if your parents are African, move then highlight bar using thes DOWN ARROW to the option [ Africa ] and then press ENTER. If you have ancestors from more than one place, pick the option that you feel is the closest to the correct one. If you are a man and have had sex with a woman, or if you are a woman and have had sex with a man, then choose the option [ Heterosexual ]. If you have never had sexual intercourse, then choose [ No Sexual Experience ]. If you have had sexual experiences with a person of your own sex, choose [Homosexual or Bisexual]. Choose the option that most accurately describes the number of different people with whom you have had sex since 1980. For example, if you have had sex with 1 person, then choose the option [ 1 ]. Another example: If you have had sex with 17 different people since 1980, then choose thee option [ 10-19 ]. A blood transfusion is when a doctor gives you. another persons blood. It is usually done in a. hospital. Answer [ Yes ] if you have received blood in this way since 1980. Do NOT answer yes if you have only donated (given) your blood. Haemophilia is a rare disease. A person with this disease bleeds more than normal when he is injured and requires regular medication for his entire life. Answer [ No ] to thisr questions unless you have been told by au doctor that you have haemophilia. Tuberculosis is a common disease in Africa. Most often it infects the lungs causing a person to cough seriously and to spit blood sometimes. Answer [ Yes ] to this question only if you have an active case of tuberculosis now. If you once had it but are now completely cured, then answer [ No ]. Addictive drugs include heroin and morphine. Ifu you inject these without the approval of a doctor, then answer [ Yes ]. Inject means to use at needle and a syringe tor put the drug into your body. A sexually transmitted disease is one that your got from having sex with an infected person. There are many types. Most make infections on or around your sexual organs. Most would cause you to look for medical treatment. Gonorrhoea, syphilis and open sores are examples. Answer [ Yes ] even if you are completely cured. A condom is a thin rubber covering that is worn by a man during sex. It covers his sexual organ. Sometimes it is used for family planning or for contraception. The words rubber, safe, or French letter are other names for a condom. Answer [ Yes ] if you had homosexual intercourse over any time period of 5 years or more, regardless of your current sexual behaviour. Answer [ No ] if the time period is less than 5 years, or if you have not had any homosexual relations since the year 1978. Answer [ Yes ] if you have have been the passive (receiving) partner in homosexual intercourse. Nitrates are drugs that are used during sex. They affect the mood and the feelings of the user. Usually they are taken by breathing them into the nose from a small glass bottle. A prostitute is a person who provides sex for payment. If you pay a person for sex, then answer [ Yes ] to this question. You answered a previous question about age with a response of [ 0-3 years ]. If the mother of this infant is known to be infected with the AIDS virus, answer [ Yes ] to this question. If you have had sexual intercourse with a man feel lumps in these places, and they may cause slight discomfort or pain when touched. Answer [ Yes ] if you can feel these lumps (swollen lymph glands) deep under your skin now. Answer [ Yes ] if you have had many infections recently of your mouth or throat that produce a white or red patch that can be seen. Answer [ Yes ] if you have an infection now that does not go away. Answer [ No ] if you get a sore throat just once in a while like most people. Answer [ Yes ] if you have had a deep, heavy cough for more than one month. Answer [ No ] if you are sure that this cough is caused by smoking, by allergies or by asthma. Answer [ No ] if it was long ago and not now. Answer [ Yes ] if you have had an unexplained fever (high body temperature) for more than one month. Answer [ No ] if you are sure that it was caused by malaria. Answer [ No ] if it was long ago and not now. Answer [ Yes ] if you have had skin infections in many places on your body in recent months. Answer [ Yes ] if you. have had a big infection all over your skin. Answer [ No ] if it was not during the last year. Answer [ Yes ] if you have have had a problem for more than one month of excess sweating at night even when the climate is not warm. Answer [ No ] if you are sure that it is cause by malaria. Answer [ No ] if it was long ago and not If you feel that you have lost energy and that you are always tired for no obvious reason, then answer [ Yes ] to this question. The computer has used the information that you have provided. It has done a set of calculations that estimates your risk of exposure to AIDS. You do not need to answer any questions at this point. Your AIDS risk group is. shown in the box. It was computed based on thew information that you have provided. It estimates your risk of exposure to AIDS. You do not need to answer any questions now. The advice provided on the screen is designed especially for you. Read it carefully and then do what it suggests. You are now well informed. Don't die from failing to protect yourself. You do not need to answer any questions at this point. Just type any questions. about AIDS for which you want an answer. The computer will then analyze your comments and it will reply to you. If you have not used a computer in this way before, it may seem strange or surprising - but just try it and see how it works. The program has tried to reply to your comments or questions. That reply is now on the screen. If you are not satisfied with the computer's reply, then press ESCAPE for the Menu Options and press R to Repeat the last step. Then type your questions again. M E N U O P T I O N S KEY FUNCTION Q Quit C Continue R Repeat Last Step B Go to Beginning H Help G O O D - B Y E Going to the beginning Repeating last step Calling Help screen Resuming program Use Q, C, R, B, or H Sorry, can't repeat the last step You need to be very careful in the future because many of your potential sex partners are AIDS virus carriers. Carriers may look and act healthy, but you can still be infected by them. Be smart and protect your health with safe behaviour. The AIDS virus can be transmitted by sexual intercourse in the same way as other sexually transmitted diseases. Now is the right time to change your behaviour and to start practicing safe sex. Safe sex means only one sex partner and/or using condoms. " Help " " Algeria " " Angola " " Australia " " Austria " " Bahrain " " Bangladesh " " Belgium " " Benin " " Botswana " " Brunei " " Burkina Faso " " Burundi " " Cameroon " " Canada " " Cape Verde " " Central African Republic " " Chad " " China " " Comoros " " Congo " " Denmark " " Djibouti " " Egypt " " Equatorial Guinea " " Ethiopia " " Finland " " Fiji " " France " " Gambia " " Gabon " " Germany " " Ghana " " Greece " " Guinea " " Guinea Bissau " " Hong Kong " " Iceland " " India " " Indonesia " " Ireland " " Israel " " Italy " " Ivory Coast " " Japan " " Kenya " " Korea " " Kuwait " " Lesotho " " Liberia " " Libya " " Liechtenstein " " Luxembourg " " Madagascar " " Malaysia " " Malawi " " Mali " " Mauritania " " Mauritius " " Morocco " " Mozambique " " Namibia " " Nepal " " Netherlands " " New Zealand " " Niger " " Nigeria " " Norway " " Oman " " Pakistan " " Papua New Guinea " " Phillippines " " Portugal " " Qatar " " Rwanda " " Sahrawi " " Sao Tome Principe " " Saudi Arabia " " Senegal " " Seychelles " " Sierra Leone " " Singapore " " Somalia " " South Africa " " Spain " " Sri Lanka " " Sudan " " Swaziland " " Sweden " " Switzerland " " Taiwan " " Tanzania " " Thailand " " Togo " " Tunisia " " Turkey " " Uganda " " United Arab Emirates " " United Kingdom " " Zaire " " Zambia " " Zimbabwe " " Help" " Male" " Female" " Help" " 0- 3 years" " 4-12 years" " 13-19 years" " 20-29 years" " 30-39 years" " 40-49 years" " 50-59 years" " 60-69 years" " 70+ years" " Help" " Africa" " Asia" " Europe" " Latin America" " Oceania" " Other" " Help" " Heterosexual" " No Sexual Experience" " Homosexual or Bisexual" " Help" " 0" " 1" " 2- 4" " 5- 9" " 10-19" " 20-49" " 50-99" " 100+" " Help" " Yes" " No" " Help" " Yes" " No" " Help" " Yes" " No" " Help" " Yes" " No" " Help" " Yes" " No" " Help" " Never" " Rarely" " Occasionally" " Usually" " Always" " Help" " Yes" " No" " Help" " Yes" " No" " Help" " Yes" " No" " Help" " Yes" " No" " Help" " Yes" " No" " Help" " Yes" " No" " Help" " Yes" " No" " Help" " Yes" " No" " Help" " Yes" " No" " Help" " Yes" " No" " Help" " Yes" " No" " Help" " Yes" " No" " Help" " Yes" " No" " Help" " Yes" " No" " Help" " Yes" " No" Must run under DOS 2.00 or later Program too large Must link with BCOM30.LIB Random Number Seed (-32768 to 32767)$