Simtel MSDOS 1992 September/Simtel20_Sept92.cdr/msdos/trojanpr/aidstech.arc/AIDSTECH.DOC

Text File | 1989-12-22 | 87KB | 1,885 lines

By Dr Alan Solomon, Barry Nielson and Simon Meldrum

The authors can be contacted at the following address:

Water Meadow
Chesham,
Bucks, HP5 1LP
England

Contents

Summary
The diskette
When it is installed
The trojan
The software
Analysis of the software
Analysis of the license
Analysis of the purpose
How it all happened
Conclusions

Appendix 1 - The blue piece of paper
Appendix 2 - Details of the installation
Appendix 3 - How to remove it
Appendix 4 - The encryption of filenames
Appendix 5 - The damage routine
Appendix 6 - The Share routine
Appendix 7 - Messages in the AIDS program

Summary

On Monday, 11th December, several thousand diskettes were mailed out
containing a program that purported to give you information about
AIDS.  These diskettes actually contained a trojan - do not install
the program.  If you have installed it, you must remove it - see
Appendix 3 below for how.

The diskette

The diskette was sent out to 7,000 subscribers to the magazine PC
Business World, and also to a list obtained from the WHO conference on
AIDS in Stockholm in October 1988.  There may be other recipients, but
this has not been confirmed.

The diskette arrives in a square white envelope, containing a diskette
and a blue piece of paper.  The label on the diskette says "AIDS
Information Introductory Diskette Version 2.0", and give the following
instructions:

1. Start your computer
2. Insert this diskette in drive A
3. At the C> prompt, type A:INSTALL
4. Press ENTER

If you do this, it installs itself on your computer - this process is
described in more detail below in appendix 2.  The files on the
diskette are:

INSTALL.EXE      Sept 28 1989  146188 bytes
AIDS.EXE          Aug  7 1989  172562 bytes

The accompanying blue piece of paper is documented in appendix 3

When it is installed

When the installation is complete, a number of new files are on your
hard disk.  Extensive use is made of character 255 (hexadecimal FF)
which is invisible.  For the purposes of this report, we shall
represent it as #.  The "Space" character shall be represented as ~.

A file called AIDS.EXE is put on the root directory.  Two hidden
subdirectories are created in the root, called # and ###~### (using
the notation defined above).  The # subdirectory contains a readonly,
hidden file called REM#.EXE.

The ###~### subdirectory contains a hidden subdirectory called
##~####, which contains a hidden subdirectory called ####~##, which
contains a subdirectory called ERROR~IN.THE, which contains nothing.
The ####~## subdirectory also contains five files ____.~__, _.~_~,
___.~~_, _.~~_ and _.~__ (where _ is the underline character, Acsii
95, and ~ is the space character, Acsii 32).  These files are all
readonly and hidden.

____.~__ contains 17 bytes, and looks like it is the serial number
that the trojan gives you (see description of installation), but
encrypted.  _.~_~ is six bytes and is a counter, counting the number
of times that REM# has been run.  After the first run of REM#, it is
eight bytes.  ___.~~_ is one byte, an end-of-file marker (Ascii 26).
_.~__ is 50401 bytes long, and consists of 252-byte records,
containing 250 spaces and a carriage-return, line-feed.

The installation also creates a new AUTOEXEC.BAT file, consisting of:

echo off
C:
cd\#
rem# PLEASE USE THE auto.bat FILE INSTEAD OF autoexec.bat FOR CONVENIENCE #
auto.bat

AUTO.BAT contains:

echo off
rem #PLEASE USE THIS FILE JUST LIKE AN autoexec.bat FILE FOR CONVENIENCE#

This is followed by "echo on", and then the lines from your original
AUTOEXEC.BAT - if you didn't have an AUTOEXEC, it has:

date
time


It also leaves a file called AUTOEXEC.BAK behind - this contains
"File not found". Perhaps if there was a file on the disk with a
certain name, this might contain the contents of that file.
If you had a file called AUTO.BAT, it is over-written.

The  "important reference number" varies from installation
to installation; every time the same diskette is installed, you get
a different number.

The trojan

Every time the computer is rebooted, AUTOEXEC runs the REM# program,
and the counter counts.  In all the tests that we have done, it counts
for precisely 90 boots.  After 90 boots, it goes into the damage
routine, which puts a series of messages up on the screen aimed at
preventing you from switching off, and spends a very long time
accessing the disk.  What it is actually doing, is first encrypting
the file names on the disk (see Appendix 4 for the encryption system)
and then it creates a very large file on the disk, filling it up.

The software

The AIDS program itself starts off by asking you a series of
questions about your lifestyle, including your country. The United
States is not an option here - this is consistent with the license
agreement's statement that the programs are not to be used there.
This program does not appear to do anything untoward to the computer,
but it is impossible to be certain about this. In appendix 6, we list
the text that is to be found inside the program.

When the questionnaire has been completed, the program gives you a
risk assessment on a scale of no risk to very high risk, and makes
some suggestions about how you can reduce your risk. It then offers
a screen into which you can type free-form questions, and gives
you answers. This phase appears to be looking for keywords, and
on recognising the keywords, it presents responses - this is a very
simple thing to program.

The INSTALL proram becomes the REM# program once installed - it is als
also the SHARE program. We have done a Dos COMP to verify this.

Analysis of the software

The software is a mixture of very simple, and rather complex.  The
AIDS program itself has features that look quite badly written - for
example, the messages are repetitive, and the free-form question and
answer routine looks like it picks out keywords and gives responses
based on those.  The REM# routine has an encryption system that uses
an IF - THEN - ELSE on a character by character basis, rather than a
string lookup, or an algorithm.  The program is written in Basic.

On the other hand, the program creates hidden subdirectories, and in
order to do this in Basic, a routine written in another language must
be linked in.  Also, the program intercepts Ctrl-Alt-Del, and this can
only be done by intercepting interrupt 9;  assembler is required.

So, the software is a mixture of the very simplistic, and the rather
sophisticated. Perhaps this is the work of two programmers, or
maybe one programmer who used routines from another source.

Analysis of the license

The license looks like every other software license, unless you read
it very carefully.  If you read it carefully, you can see the hooks.
First, it tells you about the "program mechanisms" to stop you using
the software.

In the case of your breach of this license agreement, PC Cyborg
Corporation reserves the right to take any legal action necessary to
recover any outstanding debts payable to PC Cyborg Corporation and to
use program mechanisms to ensure termination of your use of the
programs.

Then, it warns you that this will affect other programs.

These program mechanisms will adversely affect other program
applications on microcomputers.

Then it tells you that your computer will stop working properly.

You are hereby advised of the most serious consequences of your
failure to abide by the terms of this license agreement;  your
conscience may haunt you for the rest of your life;  you will owe
compensation and possible damages to PC Cyborg Corporation;  and your
microcomputer will stop functioning normally.  Warning:  Do not use
these programs unless you are prepared to pay for them.

Earlier on in the agreement, it explains that there is a mandatory
licensing fee - the programs are not free.  So the subsequent demands
for money - are they blackmail, or are they debt-collection?  It may
require a court case to decide.

Analysis of the purpose

What is the point of this diskette?  Is it the obvious one - PC Cyborg
is trying to sell software by direct mailshot, and is trying to
enforce payment by people who voluntarily decide to run it, and
therefore voluntarily decide to buy it?  Or is it an attempt at
blackmail - PC Cyborg realised that no-one would actually read the
license, but that many would run the program.  Or is it sabotage -
some organisation wishes to inflict damage on a large number of
computers?  Or is it purely random - someone without rational motives?

Certainly, a large sum of mony has been spent on this mail-out. At
least 10,000 diskettes have been posted (cost - perhaps 10,000),
and a PO Box and company have been set up, and a large amount of
software development undertaken. A figure of 20,000 is probably
an under-estimate. Who would want to spend this sort of money?

It is difficult to take this diskette at face value. Surely, no-one
would really expect that sufficiently many people would voluntarily
send $189 or $378 to a PO Box in Panama. And even when the trojan
is revealed, it is hard to believe that many people would send off
their money, especially as the encryption of file names would appear
to be easily reversible. In the light of the careful preparation of
this diskette, and the large sum of money spent, it is surely not
possible that the crude attempt at blackmail (if that is what it is)
is the only outcome.

Is it possible that we haven't heard the last from PC Cyborg?  Is it
possible that in several weeks time, we will get another letter which
is the real ransom note?  Or is this perhaps an attempt to blackmail
the next magazine that they might approach - certainly a mail-out of
this kind to a magazine's readers, does that magazine no good at all.
so, a threat to do the same trick to another magazine might be the
objective.

On the other hand, is it possible that we are dealing with simple
crackpots?  If so, there may be no motive, and what we have seen is
all there is.

The only hard fact we have, is that we do not know the motive behind
this mailshot, and our recommendation on how to remove the trojan is
based on this fact.

How it all happened

In April 1989, PC Cyborg Corporation was set up in Panama City with
$10,000 equity.  The three directors were Kitain Mekonen, Asrat
Wakjira and Fantu Mekesse.  The local agent was Lucio Bernal.  In
October 1989, Mr E Ketema took out a month's subscription to the
Business Centre in New Bond Street, London;  he claimed to be an
accountant.

A Mr E Ketema (not necessarily the same person) asked PC Business
World if he could do a mailshot to 7000 of their readers.  PC Business
World, in common with most magazines, rent their mailing list to
anyone who meets certain conditions.  Mr Ketema operated out of a
rented address at a Business Centre - there is no forwarding address.

Mr Ketema told the magazine that he would be sending out leaflets
advertising software written in Nigeria.  In fact, the AIDS diskette
was sent out to this list.  The sender also used a list of 3000 that
came from an AIDS conference in Stockholm in October 1988, and may
have used other lists (this is unconfirmed).

On Tuesday, the diskettes began to arrive.  Many people were made
suspicious by the license, and refrained from running the software,
but many others installed it.  We put out a warning on the Tuesday,
via CONNECT, the IBM PC User Group's conferencing system, and we also
informed the police.  The press picked up the story from Connect, and
on Wednesday morning, there was a front-page article warning people
not to install the software.  The other press picked it up from that,
and soon the fact of the trojan was reasonably well known.

Throughout Wednesday, Thursday and Friday, the diskettes continued to
arrive - most of them were intercepted by alert PC support staff, but
some were delivered directly to users, and were run.  On Thursday, we
received our first confirmed report of the program's trojan
activating.  Since then, we have received reports of others.  Some
sources say that the trojan activates before the 90th boot-up, some
even say that it activates on the first.

On Thursday, Panama declared war on the US. This is almost certainly
unrelated, as the trojan planning must have happened over the last
several months. But it will make it more difficult to investigate
the PO Box and the PC Cyborg Corporation.

PC Business World have reacted in a very responsible manner, even
though they are not to blame for the AIDS trojan;  they have
commissioned research into the effects of the diskette, and have
offered affected readers a program "AIDSOUT" that removes the obvious
files that the trojan installs.  They agree, however, that for maximum
caution, anyone who has installed the trojan should proceed as
outlined in this paper.

Conclusions

We may never know the full story of this program - what the intentions
were, and what the programs do.  But it is very surprising how many
people ran the trojan, and it is clear that many companies will wish
to take action to ensure that nothing like this ever happens in
future.  Demo diskettes sent through the post may become a thing of
the past, and diskettes on the front covers of magazines might be
adversely affected by the fallout.  Certainly, a number of companies
will change their rules about what people are allowed to load onto
their computers and what is not allowed, and some companies that
already have firm rules will probably be taking steps to enforce them.

Many companies that had previously been hit by a virus got off
lightly;  many PC support staff spoke to us and said that they had run
it on an isolated test machine, and as a result, were making sure that
no-one else ran it.  One company had PC support staff at the front
entrance, handing out warning leaflets as people entered in the
morning.

Other companies have been hit hard, with the program going into its
trojan phase, and making their computers inaccessible, at least
temporarily.



APPENDICES

Appendix 1 - The blue piece of paper

The enclosed blue piece of paper says, on the front:


AIDS Information - Introductory Diskette

Please find enclosed a computer diskette containing health information
on the disease AIDS.  The information is provided in the form of an
interactive computer program.  It is easy to use.  Here is how it
works:

The program provides you with information about AIDS and asks you
questions

You reply by choosing the most appropriate answer shown on
the screen

The program then provides you with a confidential report on
your risk of exposure to AIDS

The program provides recommendations to you, based on the life history
information that you have provided, about practical steps that you can
take to reduce your risk of getting AIDS.

The program gives you the opportunity to make comments and ask
questions that you may have about AIDS

This program is designed specially to help:  members of the public who
are concerned about AIDS and medical professionals.

Instructions

This software is designed for use with IBM (R) PC/XT tm microcomputers
and with all other truly compatible microcomputers.  Your computer
must have a hard disk drive C, MS-DOS (R) version 2.0 or higher, and a
minimum of 256K RAM.  First read and assent to the limited warranty
and to the license agreement on the reverse.  [If you use this
diskette, you will have to pay the mandatory software leasing fee(s).]
Then do the following:

Step 1:  Start your computer (with diskette drive A empty).

Step 2:  Once the computer is running, insert the Introductory
Diskette into drive A.

Step 3:  At the C> prompt of your root directory type:  A:INSTALL and
then press ENTER.  Installation proceeds automatically from that
point.  It takes only a few minutes.

Step 4:  When the installation is completed, you will be given
easy-to-follow messages by the computer.  Respond accordingly.

Step 5:  When you want to use the program, type the word AIDS at the
C> prompt in the root directory, and press ENTER.

On the reverse side of the blue paper it has:

Limited Warranty

If the diskette containing the programs is defective, PC Cyborg
Corporation will replace it at no charge.  This remedy is your sole
remedy.  These programs and documentation are provided "as is" without
warranty of any kind, either express or implied, including but not
limited to the implied warranties of merchantability and fitness for a
particular purpose.  The entire risk as to the quality and performance
of the programs is with you.  Should the programs prove defective, you
(and not PC Cyborg Corporation or its dealers) assume the entire cost
of any servicing, repair or correction.  In no event will PC Cyborg
Corporation be liable for any damages, including loss of profits, loss
of savings, business interruption, loss of business information or
other incidental, consequential, or special damages arising out of the
use of or inability to use these programs, even if PC
CyborgCorporation has been advised of the possibility of such damages,
or for any claim by any other party.

License Agreement

Read this license agreement carefully.  If you do not agree with the
terms and conditions stated below, do not use this software, and do
not break the seal (if any) on the software diskette.  PC Cyborg
Corporation retains the title and ownership of these programs and
documentation but grants a license to you under the following
conditions:  You may use the programs on microcomputers, and you may
copy the programs for archival purposes and for purposes specified in
the programs themselves.  However, you may not decompile, disassemble,
or reverse engineer these programs or modify them in any way without
consent from PC Cyborg Corporation.  These programs are provided for
your use as described above on a leased basis to you;  they are not
sold.  You may choose one of the following types of lease (a) a lease
for 365 user applications or (b) a lease for the lifetime of your hard
disk drive or 60 years, whichever is the lesser.  PC Cyborg
Corporation may include mechanisms in the programs to limit or inhibit
copying and to ensure that you abide by the terms of the license
agreement and to the terms of the lease duration.  There is a
mandatory leasing fee for the use of these programs;  they are not
provided to you free of charge.  The prices for "lease a" and "lease
b" mentioned above are US$189 and US$378, respectively (subject to
change without notice).  If you install these programs on a
microcomputer (by the install program or by the share program option
or by any other means), then under the terms of this license you
thereby agree to pay PC Cyborg Corporation in full for the cost of
leasing these programs.  In the case of your breach of this license
agreement, PC Cyborg Corporation reserves the right to take any legal
action necessary to recover any outstanding debts payable to PC Cyborg
Corporation and to use program mechanisms to ensure termination of
your use of the programs.  These program mechanisms will adversely
affect other program applications on microcomputers.  You are hereby
advised of the most serious consequences of your failure to abide by
the terms of this license agreement;  your conscience may haunt you
for the rest of your life;  you will owe compensation and possible
damages to PC Cyborg Corporation;  and your microcomputer will stop
functioning normally.  Warning:  Do not use these programs unless you
are prepared to pay for them.  You are strictly prohibited from
sharing these programs with others, unless:  the programs are
accompanied by all program documentation including this license
agreement;  you fully inform the recipient of the terms of this
agreement;  and the recipient assents to the terms of the agreement,
including the mandatory payments to PC Cyborg Corporation.  PC Cyborg
Corporation does not authorize you to distribute or use these programs
in the United States of America.  If you have any doubts about your
willingness or ability to meet the terms of this license agreement or
if you are not prepared to pay all amounts due to PC Cyborg
Corporation, then do not use these programs.  No modification to this
agreement shall be binding unless specifically agreed upon in writing
by PC Cyborg Corporation.

Programs (c) copyright PC Cyborg Corporation, 1989

Compiler runtime module (c) copyright Microsoft Corporation, 1982-1987

All Rights Reserved

IBM (R) is a registered trademark of International Business Machines
Corporation.  PC/XT TM is a trademark of International Business
Machines Corporation.  Microsoft (R) and MS-DOS (R) are registered
trademarks of Microsoft Corporation.

Appendix 2 - Details of the installation

When you run A:INSTALL.EXE, the following happens. First, it clears
the screen, and puts up in a box:

                  \\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\
                  ]                                       ~
                  ]       Installation in progress.       ~
                  ]                                       ~
                  ]              Please wait.             ~
                  ]                                       ~
                  _________________________________________

Then, it puts up the following:


              \\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\
              ]                                                  ~
              ]              TURN ON THE PRINTER                 ~
              ]     and then press the ENTER or RETURN key.      ~
              ]                                                  ~
              ____________________________________________________


And when you do that, you see:




 Dear Customer:

 It is time to pay for your software lease from PC Cyborg Corporation.
 Complete the INVOICE and attach payment for the lease option of your choice.
 If you don't use the printed INVOICE, then be sure to refer to the important
 reference numbers below in all correspondence. In return you will receive:

 - a renewal software package with easy-to-follow, complete instructions;
 - an automatic, self-installing diskette that anyone can apply in minutes.

 Important reference numbers: A31565-1043251-

 The price of 365 user applications is US$189. The price of a lease for the
 lifetime of your hard disk is US$378.  You must enclose a bankers draft,
 cashier's check or international money order payable to PC CYBORG CORPORATION
 for the full amount of $189 or $378 with your order. Include your name,
 company, address, city, state, country, zip or postal code. Mail your order
 to PC Cyborg Corporation, P.O. Box 87-17-44, Panama 7, Panama.

                           Press ENTER to continue



It also prints to your printer


 Dear Customer:

It is time to pay for your software lease from PC Cyborg Corporation.
Complete the INVOICE below and attach full payment for the lease
option of your choice.  Be certain to refer to the important reference
numbers below in all correspondence.  In return you will receive:

 - a renewal software package;
 - easy-to-follow, complete instructions;
 - an automatic, self-installing diskette;
 - it takes only minutes;
 - anyone can do it.

-----------------------------------------------------------------

 Important reference numbers: A31565-1043251-

I am paying for my PC Cyborg Corporation software lease for 365 user
applications (approximately one year) at USD189 or for the lifetime of
my hard disk (max.  of 60 years) at USD378.  I have enclosed a bankers
draft, cashier's check or international money order payable to PC
CYBORG CORPORATION for the full amount of 189 or 378 US dollars.


Name:_____________________________________________________________

Title:____________________________________________________________

Company:__________________________________________________________

Address:__________________________________________________________

City:_____________________________________________________________

State:____________________________________________________________

Country:__________________________________________________________

Zip or Postal Code:_______________________________________________

Mail this completed ORDER FORM with the full payment to:
    PC Cyborg Corporation, P.O. Box 87-17-44, Panama 7, Panama.


Then the installation procedure puts on the screen:


             \\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\
             ]                                                   ~
             ]          The installation is completed.           ~
             ]                                                   ~
             ]    You are now required to complete the invoice   ~
             ]                                                   ~
             ]      and send full payment for this software.     ~
             ]                                                   ~
             ]        Please do so immediately to avoid an       ~
             ]                                                   ~
             ]        inconvenient interruption of service.      ~
             ]                                                   ~
             ]                                                   ~
             ]                                                   ~
             ]   When you want to use the program, type AIDS at  ~
             ]                                                   ~
             ]   the C> prompt.  You will not need the original  ~
             ]                                                   ~
             ]   floppy diskette again, so give it to a friend.  ~
             ]                                                   ~
             ]   Thank you. Press ENTER to return to C> prompt.  ~
             ]                                                   ~
             _____________________________________________________



When you press ENTER, you are returned to the C prompt.



Appendix 3 - How to remove it

It would seem that you can disable the trojan by simple changing the
AUTOEXEC so that the REM# program no longer runs, and then you could
tidy up the various hidden subdirectories.  We do not recommend this
procedure, for the following reason.

Many researchers have run the install routine, and they have all
reported that no other executables on the disk are changed.
Unfortunately, this negative evidence is not proof, and if you want to
adopt the maximum caution in removing the trojan, you have to make the
assumption that under some circumstances, it might modify another
executable, in order to do damage later.  We have not observed it
doing this, but we cannot prove that it doesn't without a full
disassembly of the trojan.  Until this is done (it will take several
months, at least), we would suggest that people wanting to adopt the
maximum caution proceed as follows.

1. Switch off the computer
2. Put a known clean Dos diskette in drive A.
3. Switch on the computer
4.  Copy any recent data onto diskettes;  do not run any executables
on the hard disk.
5.  Low level format the disk (if you don't know how, consult your
manuals).  Make sure that you enter the bad track table, if any.
6. Run Fdisk to partition the disk.
7.  Format the disk.  Some computers combine steps 5 to 7, and some
programs (such as Disk Manager) make this process easier.
8.  Replace all executables from a backup made before the trojan was
installed.
9. Replace the recent data that was copies at step 4.

This procedure will not mean that you lose any data, but it does take
longer than running a program to remove the hidden directories and
other material installed on the disk.  The advantage of this
procedure, is that it makes certain that, if the trojan has altered
any of your executables, you will not have any unpleasant surprises
later.  If you decide to do this procedure at a later date, it will be
more of a nuisance, as you will have to go back further in time to get
a pre-trojan backup.

Appendix 4 - The encryption of filenames

When the trojan is triggered, it encrypts most of the file names
on the disk, using the Dos RENAME function. This isn't trapped by
active monitor programs such as Flushot Plus. It encrypts only files
which are not readonly, and only files with an extension from the
list given below. The encryption system is very simple, and is as
follows. Filenames are encrypted, extensions are encoded using the
list below.

Original       Encrypted
Character      Character

!                S
#                (
$                3
%                W
&                7
' (apostrophe)   $
(                B
)                %
- (minus)        2
0                9
1                F
2                Y
3                $
4                J
5                E
6                T
7                )
8                M
9                - (minus)
@                L
A                ^G (control-G)
B                U
C                _ (underline)
D                @
E                8
F                !
G                ' (apostrophe)
H                Q
I                #
J                D
K                A
L                P
M                C
N                1
O                R
P                X
Q                Z
R                H
S                &
T                6
U                G
V                O
W                K
X                V
Y                N
Z                I
^H (control-H)   ^
_ (underline)    0
$                4
^G (control-G)   5
^                ^H (control-H)


The file extensions are encoded to <space><letter><letter>n The
encoding is:

>From    To

<blank> AB
APP     AC
BAK     AD
BAS     AF
BAT     AG
CAT     AH
CMP     AI
CNF     AJ
COM     AK
DAT     AL
DB      AM
DBF     AN
DCT     AO
DEM     AP
DIR     AQ
DOC     AR
DVC     AS
DYN     AT
EXE     AU
FIL     AV
FNT     AW
FRM     AX
GLY     AZ
HLP     BA
INI     BB
INP     BC
LBR     BD
LOC     BF
MDF     BG
MNU     BI
MSG     BJ
NDX     BK
OUT     BL
OVL     BM
OVR     BN
PGM     BO
PIF     BP
PRD     BQ
PRG     BR
PRN     BS
SCR     BU
SET     BV
SK      BW
REC     BX
STY     BY
SYS     BZ
TBL     CA
TXT     CB
WK1     CC
WK2     CD
WKS     CE
XLT     CF
XQT     CG
ZBA     CH
DRV     CI
LRN     CJ
CAL     CK
FON     CL
SPL     CM
MAC     CN
TST     CO
LGO     CP
GRB     CQ
GRA     CR
DTA     CS
PAS     CW
OBJ     CX
MAP     CY
LST     CZ
LIB     DA
ASM     DB
BLD     DC
COB     DD
COD     DE
FOR     DF
FMT     DG
DIF     DH
DRW     DI
FLB     DJ
PIC     DK
PAT     DL
VFN     DM
GEM     DN
REN     DO
IMG     DP
RSC     DQ
MEM     DR

Illustration of a possible decryption routine, in BASIC

10 A$ = "!#$%&'()-0123456789@ABCDEFGHIJKLMNOPQRSTUVWXYZ^H_$^G^"
20 B$ = "S(3W7$B%29FY$JET)M-L^GU_@8!'Q#DAPC1RXZH&6GOKVNI^045^H"
30 INPUT T$
40 O$ = ""
50 FOR COUNT = 1 TO LEN(T$)
60 O$ = O$ + MID$(A$,INSTR(B$,MID$(T$,COUNT,1)),1)
70 NEXT
80 PRINT O$
90 END

PSEUDO-CODE FOR CLEAN-UP ROUTINE

        findfirst / findnext <--------------<----------------+----+
                                                             |    |
        if (dir) store current then move up it --------------+    |
                                                             |    |
        if (no more files) if (root) exit ---> *END*         |    |
                             else change back ---------------+    |
                                                             |    |
        if (AIDS system file) -------------------------------+    |
                                                                  |
        if (R/O or extension other than <SP>[A/B/C/D]?) ------+   |
                                                              |   |
        look-up extension                                     |   |
        if (not in table) ------------------------------------+   |
          else replace extension                              |   |
                                                              |   |
        replace characters in filename from cipher            |   |
                                                              |   |
        write: write to floppy/ies under recovered filename <-+   |
               (Attribute bits should be RESET) ------------------+


Appendix 5 - The damage routine

After you have booted the computer 90 times (that 90 has been reported
as other values elsewhere, so it could be a variable), the trojan
triggers.  It tries to read from drive A, and either does so,
or hangs the computer. When you start up again, you get:

\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\
]                                                                          ~
]              Please wait  30  minutes during this operation.             ~
]                                                                          ~
] WARNING - do NOT turn off the computer because you will damage the files ~
]                                                                          ~
]    on the hard disk drive.   You will receive more information later.    ~
]                                                                          ~
____________________________________________________________________________

The 30 changes to 29 (sometimes to 28, 27 or 26) after a while, and
then you get:

\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\

        Sorry for the long delay ... still processing ... please wait.        *
\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\

This is left on the screen for a short while, and then you get:


Please wait during this operation.  Warning, do not turn off the computer while

the hard disk drive is working.  A flashing hard disk access light means: WAIT!


This stays up for a very long time while the disk light flashes$ the
program is writing the very long data file that fills up the disk.
When it is finished, it puts up:


                  \\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\
                  ]                                         ~
                  ] Insert the software RENEWAL DISKETTE or ~
                  ]                                         ~
                  ]  the USED SHARE DISKETTE into drive A   ~
                  ]                                         ~
                  ]     and then press ENTER or RETURN.     ~
                  ]                                         ~
                  ___________________________________________

The software renewal diskette is presumably the diskette that you
are expecting back from Panama. We put in a blank formatted
diskette, and the program replied with:


              \\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\
              ]                                                  ~
              ] The software lease for this computer has EXPIRED.~
              ] If you wish to use this computer, you must renew ~
              ] the software lease.                              ~
              ]                                                  ~
              ]                                                  ~
              ]                                                  ~
              ] For further information on the renewal procedure ~
              ] and for an order form please:                    ~
              ]                                                  ~
              ]                                                  ~
              ]                                                  ~
              ]               TURN ON THE PRINTER                ~
              ]      and then press the ENTER or RETURN key.     ~
              ]                                                  ~
              ____________________________________________________


It then put the following up on the screen, and then printed out
the invoice again:


 Dear Customer:

 It is time to pay for your software lease from PC Cyborg Corporation.
 Complete the INVOICE and attach payment for the lease option of your choice.
 If you don't use the printed INVOICE, then be sure to refer to the important
 reference numbers below in all correspondence. In return you will receive:

 - a renewal software package with easy-to-follow, complete instructions;
 - an automatic, self-installing diskette that anyone can apply in minutes.

 Important reference numbers: A31565-1043251-

 The price of 365 user applications is US$189. The price of a lease for the
 lifetime of your hard disk is US$378.  You must enclose a bankers draft,
 cashier's check or international money order payable to PC CYBORG CORPORATION
 for the full amount of $189 or $378 with your order. Include your name,
 company, address, city, state, country, zip or postal code. Mail your order
 to PC Cyborg Corporation, P.O. Box 87-17-4tl Panama 7, Panaman

                           Press ENTER to continue

After a short while, it went into the routine that we have named the
SHARE routine.


Appendix 6 - the Share routine

The SHARE routine is an attempt to persuade you to install the
trojan on another computer. It offers you another 30 applications
if you follow this routine. It starts off by putting up the
following on the screen:

             \\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\
             ]                                                   ~
             ]    If you would like to receive an additional     ~
             ]                                                   ~
             ]       thirty applications of this software,       ~
             ]                                                   ~
             ]     you may be eligible.  A useful extension      ~
             ]                                                   ~
             ]      procedure exists for that purpose.  You      ~
             ]                                                   ~
             ] meet the terms of the agreement for the extension ~
             ]                                                   ~
             ]     by sharing software with another computer.    ~
             ]                                                   ~
             ]  Insert a blank, formatted diskette into drive A, ~
             ]                                                   ~
             ]         and then press ENTER or RETURN.           ~
             ]                                                   ~
             _____________________________________________________

It then writes a file called SHARE.EXE onto the diskette, and puts
up another message.

            \\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\
            ]                                                     ~
            ] The SHARE DISKETTE in drive A is now ready for use. ~
            ]                                                     ~
            ]        Please remove it.  Take it to another        ~
            ]                                                     ~
            ]    computer.  Turn on that computer in the usual    ~
            ]                                                     ~
            ]   way.  After the computer has been booted, insert  ~
            ]                                                     ~
            ]  the SHARE DISKETTE into its drive A.  Then at the  ~
            ]                                                     ~
            ]    C> prompt type  A:SHARE  and then press ENTER.   ~
            ]                                                     ~
            ]    A short routine will follow on that computer.    ~
            ]                                                     ~
            ]  Afterwards, return the diskette to this computer.  ~
            ]                                                     ~
            _______________________________________________________


When you do that, the trojan is installed on another computer.

While this is going on, it puts up the message:

                      Sharing in progress

After returning to the first computer, you get:


              You have been credited with 30 more applications.

               These applications will begin at the time that

               you renew your software lease.  Renew the lease

                     now to resume use of the computer.





                     Press ENTER or RETURN to continue.



But you don't get the promised 30 applications.  Instead, whatever you
do on the computer, gives you this message:


WARNING!  You risk destroying all of the files on drive C.
The lease for a key software package has expired.    Renew
the lease before you attempt any further file manipulation
or other use of this computer. Do not ignore this message!

The program is pretending to be the Dos C> prompt, and it parses
whatever you type - most things it doesn't understand.  But if you
type DIR, it shows you a file that consists of the original,
directory, before it was encrypted.  Also, the command CD works, and y
you can see other subdirectories, the same way.

It understands SET and VER, but it interprets SETx as SET where x can
be anything.  Clearly the parser goes as far as a match, then stops.

If you reboot with a soft reboot (Ctrl-Alt-Del) then the reboot is
faked;  the floppy diskette is accessed, but not booted from.  But if
you hard boot from a Dos diskette, and do a dir, you see a file called
CYBORG.DOC, 1327 bytes long, containing the following.

          If you are reading this message, then your software lease
          from PC Cyborg Corporation has expired. Renew the software
          lease before using this computer again. Warning: do not
          attempt to use this computer until you have renewed your
          software lease. Use the information below for renewal.

 Dear Customer:

 It is time to pay for your software lease from PC Cyborg Corporation.
 Complete the INVOICE and attach payment for the lease option of your choice.
 If you don't use the printed INVOICE, then be sure to refer to the important
 reference numbers below in all correspondence. In return you will receive:
 - a renewal software package with easy-to-follow, complete instructions;
 - an automatic, self-installing diskette that anyone can apply in minutes.

 Important reference numbers: A31565-1043251-

 The price of 365 user applications is US$189. The price of a lease for the
 lifetime of your hard disk is US$378.  You must enclose a bankers draft,
 cashier's check or international money order payable to PC CYBORG CORPORATION
 for the full amount of $189 or $378 with your order. Include your name,
 company, address, city, state, country, zip or postal code. Mail your order
 to PC Cyborg Corporation, P.O. Box 87-17-44, Panama 7, Panama.

There is also a file on the hard disk called CYBORG.EXE. This is a
small EXE file - when disassembled, all it seems to do is set the DS
register to the current segment, and then exit with an errorlevel
of 0. But it also has some misdirection after that, as it contains
the following after the code:

<false end-file-marker>  <The Norton Utilities cannot read this file
because the FAT has been locked>

This message, plus the bytes that make up the rest of CYBORG.EXE
is stored in INSTALL.EXE near the end of the file as a string of
bytes encoded as their decimal equivalents, and separated by commas.

In the description below, we use # to denote Ascii 255, and ~ to
denote a space character (Ascii 32).

After the damage routine is triggered, there are several more files
in the ####~##. subdirectory.  The file _.~__ disappears, and files
are added. The first new file is ____.~~_, which is a one-byte
file containing an end-of-file marker. The second file is called
__.~~_, which contains the directory of the root, and each subdirectory,
before encryption. These are in a format as if someone had done
a DIR and rediected the output to a file. This file could be used
to decrypt the file names, although it is easier to use the table that
we have prepared in appendix 4. When the file was first created, it
was called ALLFILES.REC, but  it is then renamed to __.~~_

The next file is called __.~_, and this contains the message that you
would get if you type VER.  Next comes a file called ___.~_ containing
the text "IO.SYS", and another file called ___.~__ containing just
an end-of-file.

The next file fills up the rest of the disk; it is
called  ____.~_, and appears to be a database. Records are 10058
bytes long, and look like this:

DATA RECORD #1         930568    749048.6
DATA RECORD #2         252774.1   51595.27
DATA RECORD #3         162639.1  994685.6

The disk is filled up by this file. There doesn't appear to be
any pattern to the "data" in this file.



The directories after the damage routine                       ----. --
                                                               -. -
                                                               ---.  -
                                                     contains: -.  -
                                                   /           ----.  -
                                                  /            --.  -
                                                 /             --. -
                                                |              ---. -
                                                |              --. --
                                                |              ----. -
                                                /
C:\ +---  ### ###  ----  ## ####  ----  #### ##  ---- ERROR IN.THE
    |
    +---  #
           \
            \
             \
               contains: REM#.EXE
                         CYBORG.EXE
                         AUTOEXEC.BAT
                         AUTO.BAT


Appendix 7 - Messages in the AIDS program


Program too large
String Space Corrupt
wp during G.C.
STOP
 in
line
 of
module
 at address
No Line Number in
Microsoft BASIC Compiler Runtime
Version 5.60
(C) Copyright Microsoft Corp. 1982 - 1987
*Break*
Hit any key to return to system
Syntax error
RETURN without GOSUB
Out of data
Illegal function call
Overflow
Out of memory
Subscript out of range
Redimensioned array
Division by zero
Type mismatch
Out of string space
String formula too complex
RESUME without error
Device timeout
Device fault
Out of paper
CASE ELSE expected
2FIELD overflow
3Internal error
4Bad file number
5File not found
6Bad file mode
7File already open
9Device I/O error
:File already exists
=Disk full
>Input past end
?Bad record number
@Bad file name
CToo many files
DDevice unavailable
ECommunication buffer overflow
FPermission denied
GDisk not ready
HDisk media error
IAdvanced feature error
JRename across disks
KPath/file access error
LPath not found
Unprintable error
?Redo from start
Overflow
Bytes free
KYBD
SCRN
CONS
COM1
COM2
LPT1
LPT2
LPT3
*Break*
You must run the INSTALL program before you can use the AIDS program.
 I N F O R M A T I O N
AIDS Information (C) copyright PC Cyborg Corporation, 1989F
Compiler runtime module (C) copyright Microsoft Corporation, 1982-1987
All Rights Reserved
An interactive program for health education on the disease AIDS
designed for use with IBM PC/XT computers and true compatibles
requiring a hard disk drive and a minimum of 256K memory
                       I N T R O D U C T I O N
Welcome to the interactive computer program called AIDS Information. This
program is designed to provide up-to-date information about you and the
fatal disease AIDS (Acquired Immune Deficiency Syndrome). The health
information provided to you by this program could save your life.
Here is how the program works: First, the computer will ask you a series
of questions about your personal background, behaviour and medical
history. Then the program will calculate your chances of being infected
with the AIDS virus and inform you about your present degree of risk.
Then it will provide you with advice on what you can do to reduce your
risk of future infection, based on the details of your own lifestyle
and history. Finally, it will give you the chance to ask questions or to
make comments.
         U S E   T H I S   P R O G R A M   I N   P R I V A T E
The disease AIDS is often transmitted from person to person through
sexual contact. For that reason, many of the questions and answers in
the program are of a highly personal nature. For example, there are
questions about the details of your sexual behaviour. So we strongly
recommend that you use the program while you are alone, and not while
you are in the presence of other people. When answering the questions,
remember that you can be completely honest with the computer because
it keeps no records of your answers and it does not ask for your name.
Honest answers will allow the program to give you good, accurate advice
in return.
Please share the program diskette with other people so that they may
benefit from it, too. You may give them the program diskette because you
will not need it again now that you have installed it on your computer.
But you must first read and assent to the printed limited warranty and
license agreement before you may share or distribute this software.
    W H A T   Y O U   N E E D   T O   K N O W   A B O U T   A I D S
The disease AIDS is caused by a virus called HIV. The virus is passed
from person to person by sexual contact, by sharing blood products, and
through dirty needles & syringes. At the present time there is no cure
for the disease, and it is always fatal once it develops. Only people
who have the AIDS virus develop the disease AIDS. But not all people who
are infected by the virus have the actual disease. Instead, some
carry the virus for years and appear to be healthy. However, these
carriers are at risk of developing the actual disease as time passes.
Also, they are able to transmit the virus to other people with whom they
have sexual relations.
Since there is no cure for the disease, the only means by which you
can protect yourself is prevention. You can prevent being infected
through safe behaviour.  Minimizing the number of your sexual partners
and practicing safe sex are the two best ways to reduce your chances of
becoming infected. The purpose of this program is to help you understand
exactly what you can do to avoid infection.    Now, the program...
Look at the top of this screen. You will see a list of countries.
The names of the countries are in alphabetical order. Use thei
RIGHT ARROW KEY on the keyboard to move the HIGHLIGHT BAR to the
the name of the country in which you live. Then press ENTER to
select that country. If you do not see your country above, keepe
pressing the RIGHT ARROW until it appears in the list. If you go
past your country, you may use the LEFT ARROW KEY to go back.
All of the countries in Africa and many countries in Europe, Asia.
and elsewhere are in the list, so look carefully for your country.
Choose a country now, using the RIGHT ARROW or the LEFT ARROW
they are the CURSOR CONTROL KEYS on the computer keyboard),
and then press the ENTER KEY.
B A C K G R O U N D   I N F O R M A T I O N:
Country:
 was selected
Country:
 was selected
What is your sex?
 was selected
 was selected
What is your age group?
 was selected
 was selected
Choose the continent of your ancestors' origins:
 was selected
 was selected
Choose a description your sexual behaviour:
 was selected
 was selected
Choose the number of your sex partners since 1980:
 was selected
 was selected
M E D I C A L   H I S T O R Y
Have you received a blood transfusion since 1980?
 was selected
 was selected
Do you have haemophilia (bleeding disease)?
 was selected
 was selected
Do you have tuberculosis?
 was selected
 was selected
Do you inject addictive drugs?
 was selected
 was selected
Have you had a sexually transmitted disease since 1980?
 was selected
 was selected
Do you use a condom during sexual intercourse?
 was selected
 was selected
In a previous question you described your sexual behaviour as homosexual or
bisexual.  Please answer the additional questions below:
Have you had homosexual contacts for more than five years?
 was selected
 was selected
Have you been the receptive partner in anal intercourse?
 was selected
 was selected
Do you use nitrates (a type of drug) during sex?
 was selected
 was selected
Do you have sex with prostitutes?
 was selected
 was selected
In a previous question you selected the age group of 0-3 years.
Please answer the additional question below:
Is the mother of this infant infected by the AIDS virus?
 was selected
 was selected
In previous question you described your sexual behaviour as homosexual or
bisexual, and you are a female. Please answer the additional question below:
Have you had sexual intercourse with a man since 1980?
 was selected
 was selected
PLEASE ANSWER THE ADDITIONAL QUESTIONS ABOUT YOUR PRESENT HEALTH BELOW:
Have you had a large and unexplained weight loss recently?
 was selected
 was selected
Have you had diarrhoea for many months?
 was selected
 was selected
Do you have swollen glands in a number of places in your body?
 was selected
 was selected
Have you had many mouth and throat infections recently?
 was selected
 was selected.
Have you had a cough for more than one month?
 was selected
 was selected.
Have you had a fever for more than one month?
 was selected
 was selected
Do you have a generalized skin infection?
 was selected
 was selected
Do you have persistent night sweats?
 was selected
 was selected
Do you have severe and unexplained tiredness?
 was selected
 was selected
T H E   P R O G R A M   I S   W O R K I N G   O N   T H E
I N F O R M A T I O N   T H A T   Y O U   H A V E   P R O V I D E D .
P L E A S E   W A I T .
START
DONE
T H E   C A L C U L A T I O N S   A R E   N O W   C O M P L E T E .
T H E   C O M P U T E R   I S   R E A D Y   T O   G I V E   Y O U   A
P E R S O N A L   A I D S   R I S K   A S S E S S M E N T .
SEVEN LEVELS OF AIDS RISK
Extremely high risk group
Very high risk group
High risk groupg
Medium risk groupo
Low risk group
Very low risk group
No risk group
This is your AIDS risk group
Look at the list of SEVEN LEVELS OF AIDS RISK above. That list is divided
into 7 risk groups. The highest risk group is at the top. The lowest is at
the bottom. The group to which you belong is shown with an arrow and a box.
                    P E R S O N A L   A D V I C E
After careful analysis of the information that you have provided, we
offer you the following confidential advice:
You are advised that your risk of contracting AIDS is so large that
it goes off the chart of probabilities. Your behaviour patterns are
extremely dangerous, and they will very likely kill you. You are
doing a number of things that make it almost certain that you will
become infected with the AIDS virus, if you don't have it already.
Read the advice below carefully:
 This infant requires special medical attention. It is at risk because
  its mother may have passed the AIDS virus to it before it was born.
 Consult a doctor for additional information.
 When you grow up, avoid sex until you marry.
 There is no other practical advice that we can offer to young children.
Good behaviour!  For safety, avoid sex outside of marriage.
Continue to be faithful to one sex partner because that is safe.
Try to stay with one sex partner in the future for your own safety.
Decrease the number of your future sex partners to only one person.
Warning: Stay with one sex partner in the future.
Danger: You must reduce the number of your sex partners.
Danger Warning: Reduce the number of your sex partners now!
Extreme Danger: You must reduce the number of your sex partners now!
Get professional medical advice about your drug problem.
Buy condoms today at a pharmacy when you leave your office.
Always use them during sex -- never have sex without them.
See a doctor immediately; you may be very ill.
Reduce the number of your sex partners to avoid future infections.
Stay with only one sex partner to protect yourself and others.
Do these things now without delay. You have no time to waste.
Do these things to save your life and for the sake of all humanity.
You must use condoms when you have sex for your own safety.
Using condoms is the most important thing that you can do.
See a doctor immediately; you may be very ill.
Reduce the number of your sex partners to avoid future infections.
The more sex partners that you have, the greater your risk.
You are in a very dangerous risk category. You must take some steps
now to save your life. Choose your future sex partner with very
great care and have only one. Always use a condom if you have sex
outside of marriage. Follow this advice if you want to live.
We recommend that you use condoms when you have sex for your own safety.:
Using condoms is the most important thing that you can do.
Consider visiting your doctor for a check up.
You are in a dangerous risk category, but it is not too late for
you to take steps to save your life. Choose your future sex partner
with great care and have only one.  Always use a condom if you have
sex outside of marriage. If you ignore this advice you will be sorry.
Your medium risk of exposure to the AIDS virus is unacceptable if you
value your life. Take some practical steps now to reduce your risk
before it is too late. Stay with one sexual partner in the future
and use a condom if you have sex outside of marriage.
Consider visiting your doctor for a check up.
Your medium risk of exposure to the AIDS virus is unacceptable if you
value your life. Take some practical steps now to reduce your risk
before it is too late. Reduce the number of your sexual partners.
Have only one sexual partner in the future to significantly lower
your risk, and use a condom if you have sex outside of marriage.
Consider visiting your doctor for a check up.
Your risk of exposure to the AIDS virus is low, but considering that
AIDS is a fatal disease, you should take steps to further reduce your
risk. First, stay with one sexual partner in the future. Second, if
you have sex outside of marriage, then use a condom.
Your risk of exposure to the AIDS virus is low but it is increasing.
You must now change from your past patterns of having more than one.
sexual partner. If you continue to have more than one sexual partner
then you will you have a much greater risk of exposure in the future.
And it is very important for people in your risk group to use
a condom if they have sex outside of marriage.
You are like the majority of people in the world - you have a very low
risk of exposure to the AIDS virus. In fact, your risk is so small that.
there is not much that you can do to make it smaller. But you can do
something to avoid increasing your risk in the future. Avoid sexual
relations outside of marriage. Practice safe sex using a condom if you
do have sex outside of marriage. Keep the number of your future sexual
partners to a minimum. Insist that your sex partner be mutually
faithful to the relationship.
At the present time, your risk of previous exposure to the AIDS virus
is very small.  But you will face increasing danger in the future if
you continue your pattern of having sex with more than one partner.
As the AIDS virus spreads around the world, the chance that one of your
sexual partners will have it increases with time. In the future,
practice safe sex using a condom, if you have sex outside of marriage
Reduce the number of your sexual partners. Insist that your sex
partner be mutually faithful to the relationship.
According to our calculations that are based on the information that you
have provided, you have no measurable risk of contracting AIDS. If you
are worried about having AIDS, then you may be assured that you do not
need to worry. However, it is important for you to know that if your
behaviour changes in the future, then your risk of getting the AIDS virus
will also change. If you become sexually active in the future, then be
sure to practice safe sex with one partner.
Y O U R   C O M M E N T S
This part of the program gives you the opportunity to get more information
by asking additional questions about AIDS. Use the computer like a
typewriter. Type anything that comes to your mind in the space below. Then
computer will then analyze your remarks and respond to you with further
comments. Use English. Press ENTER TWICE when you are done typing. You do
not need to press ENTER at the end of each line. Words will break into two
automatically at the end of the line and the program will understand them.
Press ENTER TWICE when done typing or press ESCAPE for Menu Options.
Analyzing your comments, please wait.
 P R E P A R I N G   A   R E S P O N S E . . . P L E A S E   W A I T
AIDS QUESTION QUESTIONS THANK THANKS MEDICINE MEDICINES DRUG DRUGS
CURE CURES PREVENT PREVENTION PROTECT PROTECTED HUSBAND WIFE WIVES
CHILD CHILDREN BABY BABIES INFANT INFANTS SEX INTERCOURSE CONDOM
CONDOMS RUBBER RUBBERS SAFE AFRICA AFRICAN AFRICANS RACIAL RACE RACES
RACIST RACISTSS RACIALIST RACIALISTS PROGRAM PROGRAMS PROGRAMME
PROGRAMMES COMPUTER COMPUTERS HOMOSEXUAL HOMOSEXUALS GAY GAYS LESBIAN
LESBIANS BLOOD SALIVA SPIT SPITS SPITTING TEARS SEMEN PREGNANT
PREGNANCY ANAL ANUS KISS KISSES KISSING CONTAGIOUS SPREAD SPREADING
FOOD WATERD MOSQUITO MOSQUITOES INSECT INSECTS TOILET TOILETS SKIN
HAND HANDS TUBERCULOSIS TATTOO TATTOOS TATTOOINGS CIRCUMCISE
CIRCUMCISED CIRCUMCISION SCARIFICATION STERILE STERILIZE STERILIZATION
STERILIZING ASEPSIS ANTISEPTIC SLIM VIRUS ANTIBODY ANTIBODIES HIV
SEROPOSITIVE ARC SYMPTOM DEMENTIA BRAIN BREAST BREASTFEED
BREASTFEEDING
   R E S P O N S E   T O   Y O U R   C O M M E N T S
You did not type any comments, so the program has no response.
The program did not fully understand your comments. Would you like to
type them again using different words?  If so, press ESCAPE and then
press R to repeat the last step.
You are welcome. We are happy that you found this program useful.
Scientific studies show that you can not catch AIDS from insects.
Condoms are effective protection against the AIDS virus. But they can break:
during intercourse. And they must be used from the very beginning of a sex
fact to the end of it. Most pharmacies, drug stores, clinics and family
planning organizations have condoms available in
Computers can do some remarkable things. It is all a matter of good
programming. Because AIDS in such a great threat to human life, we did our
best to make this program usable and relevant.
No, there is no know cure for the disease AIDS. Prevention is the only
protection. Safe behaviour including keeping the number of sex partners
small and choosing them wisely is the best course of action.
There is no drug at the present time that can prevent or cure AIDS. But
there are medicines that can fight the other infections that often accompany
AIDS. See a doctor if you want specific advice or detailed information.
You mentioned toilet. It is not possible to catch AIDS from public toilets.
Furthermore, transmission of the disease through the fecal-oral routine has
not been documented.
Mosquitoes do not appear to be AIDS vectors. In other words, you will not
get AIDS from a mosquito.
The AIDS virus is easily transmitted by contaminated blood. The majority of
people who receive contaminated blood during a transfusion become infected.
Likewise, dirty needles and dirty syringes easily transmit the virus. But
it is safe to donate your blood through the blood bank. If you need a blood
transfusion yourself, it is possible to screen the blood for the AIDS virus
lbefore you receive it to be sure it is safe. Ask your doctor for details.
This computer program is interactive. In other words, it responds to
different people in different ways, depending upon the information that
they provide and the questions that they ask. Frankly, we wonder why there
are not more programs like this one available for health education.
Computers could be powerful weapons in mankind's fight against disease.
There is only a small chance of getting the AIDS virus through saliva.
Casual kissing appears to be safe. Open mouth kissing appears to be more
dangerous. It is that which often follows open mouth kissing that is most
risky. Food contaminated with saliva has not be shown to be a source of AIDS
infections. Similarly, public spitting, although unhygienic, does not cause
AIDS infections.
The AIDS virus does not pass through normal skin, so casual contact between
people does not spread it. For example, shaking hands with and AIDS victim
is not dangerous. However, contamination of ones skin with infected blood
should be avoided. Medical personnel should wear protective clothing when
they expect to be exposed to blood or blood products.
An infant can be infected with the AIDS virus before it is born if the
mother of the infant has been infected with the virus. The chance that an
unborn infant will get the virus if its mother is infected is about 50%.
The AIDS virus can also be transmitted through breast milk, although the
risks involved for a breast feeding infant are not well known at present.
There is reasonable evidence indicating that the AIDS virus first entered
the human population on the continent of Africa. Accordingly, the virus has
has more time to spread among the peoples of that continent. It also appears
that AIDS is rapidly becoming the most serious health threat in the region.
Because it affects people most commonly in their productive years of life,
social and economic costs of this disease will be very great. At the present
time central African and eastern Africa are most seriously affected, with
the disease reaching epidemic proportions in some major cities. However, all
countries in Africa have cases of AIDS, so prevention and safe behaviour is
important everywhere, including in
The AIDS virus has infected different populations to different degrees. At
the present people of African origins are at the greatest risk. This pattern
exists for a number of reasons. First of all, people who live in Africa have
been exposed to the virus for a longer period of time. Secondly, people of
African origins who live in the First World may be exposed to the virus at
high rates due to socio-economic and cultural reasons. And although the
people of all races appear to be susceptible to the disease AIDS, there is
the possibility of racial variation in susceptibility as there is with
other diseases like malaria and skin cancer. The high frequency of AIDS
among African people has led to some considerable controversy and to
polarization on the issue. Valuable time and energy that could be used in
combating the spread of the disease has been lost during unwise efforts by
some to debate its origins and to deny its very existence.
But regardless of your personal views about the origins of the virus, do not
expose yourself to danger by denying that a serious threat exists not just
for Africans but for all of humanity.
AIDS can be prevented by avoiding the virus.  It is transmitted by sexual
contact, through blood contact, and from mother to unborn child.
The best way to prevent infection by the AIDS virus is to avoid sex or to
practice safe sex with one partner. Safe sex means to use a condom if you
are in doubt about your partner's possible previous exposure to the AIDS
virus or if you may have been previously exposed to the virus yourself.
Homosexual men have a particularly large risk of exposure to the AIDS
virus. This high risk follows from the means by which the virus is passed
from one person to another. The virus is transmitted from an infected
person to a healthy one through body fluids or through blood. Homosexual
men are commonly exposed to both body fluids and to small amounts of blood
during homosexual sexual behaviour.  Male homosexuals who are promiscuous
that means having many different sex partners) have the greatest risk
of infection. Homosexual women or lesbians do not have a high risk of
exposure to the AIDS virus. Bisexual women are exposed to the same risk
of AIDS virus infection as other women who have sex with men. In
conclusion, having unprotected sex with an infected man is dangerous for
anybody. If you are a male homosexual, then always use a condom during sex.
Lesbian women do not have a high risk of AIDS infection. But bisexual
women face the same risks of exposure as heterosexual women. All peoples
can protect themselves from AIDS infections by choosing their sex partner
with great care.C
The risk of AIDS infection and it's relationship to circumcision is
somewhat complex. First of all, circumcision by traditional means can be
dangerous because unsterile tools may be used during the actual process
of circumcising. For example, the person being circumcised could be
infected by the AIDS virus if the same knife was used previously on
another person who was a carrier of the virus. There is another aspect
of circumcision that should be mentioned here: Some evidence exists which
indicates that uncircumcised men have a greater chance of infection with
the AIDS virus than circumcised men do. The reasons for this pattern are
not yet entirely clear. Overall, male circumcision if practiced under proper
medical supervision appears to be a healthy practice. And unfortunately,
traditional male and female circumcision practices without medical
supervision appear dangerous in terms of AIDS virus exposure.
Scarification for ritual or decorative purposes is dangerous in terms of
AIDS virus transmission. This practice is almost always carried out under
conditions that prevent proper sterilization of the tools. Since the tools
come into contact with the blood of more that one person, they are able to
transmit the virus from an AIDS carrier to an uninfected person.
You mentioned semen. The AIDS virus is present in the semen of a man who has
been previously infected by the virus. That man may not show any of the
symptoms of the disease AIDS, but he can still transmit the disease to
others. Men who think that they may be carriers of the AIDS virus must
always use a condom to protect others from infection, and to protect
themselves from further infection by sexually transmitted diseases.
The AIDS virus may appear in small quantities in the tears of an
infected person. However, exposure to tears is not likely to be a major
mode of transmission of the disease.
The AIDS virus can be transmitted during tattooing if dirty needles are
used. Tattoo needles must be treated like surgical instruments. They must
be fully sterilized before use. They must never be shared among people if
they cannot be sterilized before each usage.
For household use you may destroy the AIDS virus with ordinary household
chlorine bleach when cleaning linen, utensils, bathrooms, etc. Do not use
bleach on wounds. If you are a medical professional, then you need more
information. See the World Health Organization publication entitled:
WHO AIDS SERIES 2, Guidelines on Sterilization and High-Level Disinfection
Methods Effective against Human Immunodeficiency Virus (HIV). It is
ISBN 92 4 121002 8.
If a wife and husband are mutually faithful to each other, and if neither
was previously infected by the AIDS virus, then sex within marriage is
very safe. However, if a husband or wife is infected with the AIDS virus,
then it is likely that they will infect their spouse. Promiscuity is
equally dangerous for married and unmarried people. Stay with one sexual
partner and insist that your spouse does likewise.
Anal intercourse for men and women is a likely means of AIDS transmission
if one of the two people are infected with the AIDS virus. Anal intercourse
commonly damages the lining of the intestine and causes bleeding. This
injury and the associated bleeding increase the chances of infection.
Condoms appear to provide some protection to both partners during anal
intercourse.F
AIDS is sometimes called Slim disease, particularly in eastern Africa.
AIDS is a social, economic and political problem as well as a medical one.
Social structures will be disrupted, economies will be burdened and health
care resources will be overstretched as the number of AIDS cases increase.
A virus is a very small disease-producing organism.  Many human diseases
including AIDS, polio and measles are caused by viruses.
Those people who are infected with the HIV virus do produce antibodies,
but they do not seem to be very effective against the virus.
HIV means Human Immunodeficiency Virus. It is the virus that causes AIDS.
When it invades the body it causes the immune system to break down. Two
types of HIV have been discovered so far.
Seropositive means that a person has been tested for infection with HIV,
and that antibodies have been found in that person's blood. That means
the person has been exposed to the virus, but it does not necessarily
mean that the person has the disease AIDS.  AIDS can be diagnosed by the
clinical symptoms associated with the serious AIDS-related illnesses.
ARC is a condition in which a person has illnesses caused by the HIV virus,
but does not have the cancers and other fatal AIDS-related infections.
Symptoms of AIDS include weight loss, skin tumours (like Kaposi's sarcoma),
fungal infections (like Candida albicans), lung infections (like
Pneumocystis carinii pneumonia) and degenerative brain disorders.
AIDS can destroy brain cells, causing memory loss, confusion, personality
changesl incontinence and senility.
There seems to be a small chance that an infected mother can pass the AIDS
virus to a breastfeeding baby.  For further information consult your doctor.
Children between the ages of 4 and 13 have a very low risk of AIDS
infection. But younger children may have been infected before birth if
their mother was an AIDS virus carrier. Older children are at risk if
they become sexually active.
A pregnant woman who carries the AIDS virus can pass the virus to her
unborn child.
The AIDS virus is not spread through causal contact in schools, workplaces
or public places. It is not spread through water, food, eating utensils,
coughing, sneezing, insects or toilets.
You can not get the AIDS virus from food or water.
Tuberculosis is a common infection among AIDS victims in Africa.
Yes, the AIDS virus is commonly transmitted by sexual intercourse.
The program has tried to answer your question(s). If you are not satisfied
with the response, then ask the question again using different words.
Please be very specific about what you want to know.
If you would like to ask more questions, then press ESCAPE and then R.
If you would like to end the program, then press ENTER.
...................more on next page...................
(continued).
Press ENTER to continue or press ESCAPE for Menu Options.
   Now use the DOWN ARROW or UP ARROW to select a choice, then press ENTER..

    You selected  HELP

 Press ENTER to continue
 or press ESCAPE for menu

First read the information on the computer screen, then press the
ENTER key to go on to the next step.  Many nations appear in the menu
at the top of the screen.  Use the RIGHT and LEFT ARROW keys to move
the highlight bar to your country, then press the ENTER key.  You must
pick one of the countries before you can go to the next question.
If you are a man, then use the DOWN ARROW key to move the highlight
bar to the option [ Male ] and then press ENTER.  If you are a woman,
then use the DOWN ARROW key to move the highlight bar to the option [
Female ] and then press ENTER.  You must pick Male or Female before
you can go to the next question.
Pick the age group to which you belong.  For example, if you are 35
years old, then move the highlight bar using thee DOWN ARROW to the
option [ 30-39 years ] and then press ENTER.  If you are using the
program for another person such as a child, then pick the age group
that is correct for that person.
Pick the place from which your parents come.  For example, if your
parents are African, move then highlight bar using thes DOWN ARROW to
the option [ Africa ] and then press ENTER.  If you have ancestors
from more than one place, pick the option that you feel is the closest
to the correct one.
If you are a man and have had sex with a woman, or if you are a woman
and have had sex with a man, then choose the option [ Heterosexual ].
If you have never had sexual intercourse, then choose [ No Sexual
Experience ].  If you have had sexual experiences with a person of
your own sex, choose [Homosexual or Bisexual].
Choose the option that most accurately describes the number of
different people with whom you have had sex since 1980.  For example,
if you have had sex with 1 person, then choose the option [ 1 ].
Another example:  If you have had sex with 17 different people since
1980, then choose thee option [ 10-19 ].
A blood transfusion is when a doctor gives you.  another persons
blood.  It is usually done in a.  hospital.  Answer [ Yes ] if you
have received blood in this way since 1980.  Do NOT answer yes if you
have only donated (given) your blood.
Haemophilia is a rare disease.  A person with this disease bleeds more
than normal when he is injured and requires regular medication for his
entire life.
Answer [ No ] to thisr questions unless you have been
told by au doctor that you have haemophilia.
Tuberculosis is a common disease in Africa.  Most often it infects the
lungs causing a person to cough seriously and to spit blood sometimes.
Answer [ Yes ] to this question only if you have an active case of
tuberculosis now.  If you once had it but are now completely cured,
then answer [ No ].
Addictive drugs include heroin and morphine.  Ifu you inject these
without the approval of a doctor, then answer [ Yes ].  Inject means
to use at needle and a syringe tor put the drug into your body.
A sexually transmitted disease is one that your got from having sex
with an infected person.  There are many types.  Most make infections
on or around your sexual organs.  Most would cause you to look for
medical treatment.  Gonorrhoea, syphilis and open sores are examples.
Answer [ Yes ] even if you are completely cured.
A condom is a thin rubber covering that is worn by a man during sex.
It covers his sexual organ.  Sometimes it is used for family planning
or for contraception.  The words rubber, safe, or French letter are
other names for a condom.
Answer [ Yes ] if you had homosexual intercourse over any time period
of 5 years or more, regardless of your current sexual behaviour.
Answer [ No ] if the time period is less than 5 years, or if you have
not had any homosexual relations since the year 1978.
Answer [ Yes ] if you have have been the passive (receiving) partner
in homosexual intercourse.
Nitrates are drugs that are used during sex.  They affect the mood and
the feelings of the user.  Usually they are taken by breathing them
into the nose from a small glass bottle.
A prostitute is a person who provides sex for payment.  If you pay a
person for sex, then answer [ Yes ] to this question.
You answered a previous question about age with a response of [ 0-3
years ].  If the mother of this infant is known to be infected with
the AIDS virus, answer [ Yes ] to this question.
If you have had sexual intercourse with a man feel lumps in these
places, and they may cause slight discomfort or pain when touched.
Answer [ Yes ] if you can feel these lumps (swollen lymph glands) deep
under your skin now.
Answer [ Yes ] if you have had many infections recently of your mouth
or throat that produce a white or red patch that can be seen.  Answer
[ Yes ] if you have an infection now that does not go away.  Answer [
No ] if you get a sore throat just once in a while like most people.
Answer [ Yes ] if you have had a deep, heavy cough for more than one
month.  Answer [ No ] if you are sure that this cough is caused by
smoking, by allergies or by asthma.  Answer [ No ] if it was long ago
and not now.
Answer [ Yes ] if you have had an unexplained fever (high body
temperature) for more than one month.  Answer [ No ] if you are sure
that it was caused by malaria.  Answer [ No ] if it was long ago and
not now.
Answer [ Yes ] if you have had skin infections in many places on your
body in recent months.  Answer [ Yes ] if you.  have had a big
infection all over your skin.  Answer [ No ] if it was not during the
last year.
Answer [ Yes ] if you have have had a problem for more than one month
of excess sweating at night even when the climate is not warm.  Answer
[ No ] if you are sure that it is cause by malaria.
Answer [ No ] if it was long ago and not
If you feel that you have lost energy and that you are always tired
for no obvious reason, then answer [ Yes ] to this question.
The computer has used the information that you have provided.  It has
done a set of calculations that estimates your risk of exposure to
AIDS.  You do not need to answer any questions at this point.  Your
AIDS risk group is.  shown in the box.  It was computed based on thew
information that you have provided.  It estimates your risk of
exposure to AIDS.  You do not need to answer any questions now.  The
advice provided on the screen is designed especially for you.  Read it
carefully and then do what it suggests.  You are now well informed.
Don't die from failing to protect yourself.  You do not need to answer
any questions at this point.  Just type any questions.  about AIDS for
which you want an answer.  The computer will then analyze your
comments and it will reply to you.  If you have not used a computer in
this way before, it may seem strange or surprising - but just try it
and see how it works.
The program has tried to reply to your comments or questions.  That
reply is now on the screen.  If you are not satisfied with the
computer's reply, then press ESCAPE for the Menu Options and press R
to Repeat the last step.  Then type your questions again.

        M E N U
     O P T I O N S
 KEY         FUNCTION
  Q              Quit
  C          Continue
  R  Repeat Last Step
  B   Go to Beginning
  H              Help


   G O O D - B Y E
Going to the beginning
  Repeating last step
  Calling Help screen
   Resuming program
 Use Q, C, R, B, or H
Sorry, can't repeat
     the last step
You need to be very careful in the future because many of your
potential sex partners
are AIDS virus
carriers. Carriers may look and act healthy, but you can still be
infected by them. Be smart and protect your health with safe behaviour.
The AIDS virus can be transmitted by sexual intercourse in
the same way as other sexually transmitted diseases. Now is
the right time to change your behaviour and to start practicing
safe sex. Safe sex means only one sex partner and/or using condoms.
" Help " " Algeria " " Angola " " Australia " " Austria " " Bahrain "
" Bangladesh " " Belgium " " Benin " " Botswana " " Brunei " " Burkina
Faso " " Burundi " " Cameroon " " Canada " " Cape Verde " " Central
African Republic " " Chad " " China " " Comoros " " Congo " " Denmark
" " Djibouti " " Egypt " " Equatorial Guinea " " Ethiopia " " Finland
" " Fiji " " France " " Gambia " " Gabon " " Germany " " Ghana " "
Greece " " Guinea " " Guinea Bissau " " Hong Kong " " Iceland " "
India " " Indonesia " " Ireland " " Israel " " Italy " " Ivory Coast "
" Japan " " Kenya " " Korea " " Kuwait " " Lesotho " " Liberia " "
Libya " " Liechtenstein " " Luxembourg " " Madagascar " " Malaysia " "
Malawi " " Mali " " Mauritania " " Mauritius " " Morocco " "
Mozambique " " Namibia " " Nepal " " Netherlands " " New Zealand " "
Niger " " Nigeria " " Norway " " Oman " " Pakistan " " Papua New
Guinea " " Phillippines " " Portugal " " Qatar " " Rwanda " " Sahrawi
" " Sao Tome Principe " " Saudi Arabia " " Senegal " " Seychelles " "
Sierra Leone " " Singapore " " Somalia " " South Africa " " Spain " "
Sri Lanka " " Sudan " " Swaziland " " Sweden " " Switzerland " "
Taiwan " " Tanzania " " Thailand " " Togo " " Tunisia " " Turkey " "
Uganda " " United Arab Emirates " " United Kingdom " " Zaire " "
Zambia " " Zimbabwe "
" Help" " Male" " Female"
" Help" " 0- 3 years" " 4-12 years" " 13-19 years" " 20-29 years" "
30-39 years" " 40-49 years" " 50-59 years" " 60-69 years" " 70+ years"
" Help" " Africa" " Asia" " Europe" " Latin America" " Oceania" "
Other"
" Help" " Heterosexual" " No Sexual Experience" " Homosexual or
Bisexual"
" Help" " 0" " 1" " 2- 4" " 5- 9" " 10-19" " 20-49" " 50-99" " 100+"
" Help" " Yes" " No"
" Help" " Yes" " No"
" Help" " Yes" " No"
" Help" " Yes" " No"
" Help" " Yes" " No"
" Help" " Never" " Rarely" " Occasionally" " Usually" " Always"
" Help" " Yes" " No"
" Help" " Yes" " No"
" Help" " Yes" " No"
" Help" " Yes" " No"
" Help" " Yes" " No"
" Help" " Yes" " No"
" Help" " Yes" " No"
" Help" " Yes" " No"
" Help" " Yes" " No"
" Help" " Yes" " No"
" Help" " Yes" " No"
" Help" " Yes" " No"
" Help" " Yes" " No"
" Help" " Yes" " No"
" Help" " Yes" " No"
Must run under DOS 2.00 or later
Program too large
Must link with BCOM30.LIB
Random Number Seed (-32768 to 32767)$