FANDOM


Not to be confused with AIDS or OlympicAIDS.

Virus.DOS.HLLC.AIDS.8064, commonly called AIDS II, is a companion virus on DOS, written in high level programming language.

This virus was first discovered in April 1990.

BehaviorEdit

Unlike other generic file infectors, AIDS II was the second known virus to employ what could be called a "corresponding file technique" of infection so that the original target EXE file is never changed.

When the user runs a program which the virus has been dropping a viral DOS executable file having the same name, the virus is executed, followed by the host program.

These drop programs always have the size of 8,064 bytes with their timestamps at the time of infection.

PayloadEdit

After creating the companion file, the virus then plays a melody and displays the following message:

Your computer is infected with ...

♥ Aids Virus II ♥

- Signed WOP & PGT of DutchCrack -

After completion of the program, control returns to the virus. The melody is played again with the following message displayed

Getting used to me?

Next time, use a Condom .....

Other detailsEdit

Since the original EXE file remains unaltered, CRC programs cannot detect this virus having infected a system. One way to manually remove AIDS II is to check the disk for programs which have both a DOS and EXE formats, with the COM file having a length of 8,064 bytes, then it would probably the virus. The COM files thus identified should be erased.

According to Symantec, AIDS II may play a melody and display the following message:

Your computer is infected with AIDS VIRUS II

While this text string does not appear in the viral code.

ReferencesEdit

  1. Computer Viruses (A), Probert Encyclopedia
  2. AIDS II virus, McAfee
  3. AIDS II, Symantec

See alsoEdit

Ad blocker interference detected!


Wikia is a free-to-use site that makes money from advertising. We have a modified experience for viewers using ad blockers

Wikia is not accessible if you’ve made further modifications. Remove the custom ad blocker rule(s) and the page will load as expected.