%%File: VIRS0111.TXT
%%Name/Aliases: AIDS II, AIDS
%%Platform: PC/MS-DOS
%%Type: Trojan., 
%%Disk Location: AIDS Information Introductory Diskette
%%Features: 
%%Damage: Encrypts the file directory.
%%Size: Adds File REM#.EXE    146188 bytes (hidden file), Adds File 
AIDS.EXE   172562 bytes
%%See Also: 
%%Notes: On Monday, 11th December 1989, several thousand diskettes named 
"AIDS Information Introductory Diskette Version 2.0" were mailed out 
containing a program that purported to give you information about AIDS.  
These diskettes actually contained a trojan that will encrypt the file 
names on your hard disk after booting your computer about 90 times. If 
you have installed this program, you should copy any important data 
files (no executables) and reformat your hard disk.  All your file names 
are encrypted and the disk is full.   In the root directory, files 
named:  AIDS.EXE, AUTO.BAT, AUTOEXEC.BAK
Two hidden subdirectories called # and ###   ###
The # subdirectory contains a readonly, hidden file called REM#.EXE.
The ###   ### subdirectory contains a hidden subdirectory called ##   
####
The ##   #### subdirectory contains a hidden subdirectory called ####   
##
The ####   ## subdirectory also contains a subdirectory called ERROR   
IN.THE, and five files named
 ____.  __,__.   _  , ___.  _, _.   _ and _.  __ 
(where _ is the underline character,   is the space character, and # is 
Ascii 255).
  The minimum required to disable the virus is to remove the 
AUTOEXEC.BAT file that runs the program REM#.EXE and to remove all the 
hidden directories. This will not insure removal of the virus. It would 
be better backup any needed data files (no applications) and to do a low 
level format of the hard disk.
If the virus has already been activated, you can recover the encrypted 
file names using the table below in the summary, and then reformat the 
disk.