Article View: comp.virus
Article #4956AIDS TROJAN STAGE 2 UPDATE (PC)
From: IA96000
Date: Tue, 19 Dec 1989 01:46
Date: Tue, 19 Dec 1989 01:46
18 lines
1278 bytes
1278 bytes
Forgot to mention this in yesterday's update. Sorry about that! PKSCRYPT.EXE is a fine shareware program designed by Lloyd Miller in Canada, a year or two ago. It is a public key encryption program and can be used (at least SWE used it) to decrypt files encrypted by the AIDS trojan. It is available on many BBS's and Lloyd runs a FIDO BBS in Canada.It is available at (201) 249-1898 as CRYPT.ZIP Start off using 13 digit (numbers not characters) decryption keys. Three of the digits will be the major and minor numbers of your DOS version. For example DOS 4.01 would be 401, etc; Two of the digits will be the last two digits in the length of command.com if it was on the disk when stage two was triggered. It is not yet known what is used for these two digits if command.com was not present. Hope this helps somewhat!
Technical Details
Message-ID:
<0005.8912191224.AA01435@ge.sei.cmu.edu>Path:
arc1-ca.pugleaf.net!utzoo!attcan!utgpu!jarvis.csri.toronto.edu!clyde.concordia.ca!uunet!cs.utexas.edu!rutgers!netnews.upenn.edu!vax1.cc.lehigh.edu!sei.cmu.edu!krvwShow Full Headers
Complete Article Headers
Path: arc1-ca.pugleaf.net!utzoo!attcan!utgpu!jarvis.csri.toronto.edu!clyde.concordia.ca!uunet!cs.utexas.edu!rutgers!netnews.upenn.edu!vax1.cc.lehigh.edu!sei.cmu.edu!krvw From: IA96@PACE.BITNET (IA96000) Newsgroups: comp.virus Subject: AIDS TROJAN STAGE 2 UPDATE (PC) Message-ID: <0005.8912191224.AA01435@ge.sei.cmu.edu> Date: 19 Dec 89 01:46:00 GMT Sender: Virus Discussion List <VIRUS-L@IBM1.CC.Lehigh.EDU> Lines: 18 Approved: krvw@sei.cmu.edu