Path: utzoo!attcan!utgpu!jarvis.csri.toronto.edu!cs.utexas.edu!tut.cis.ohio-state.edu!purdue!haven!mimsy!tank!cps3xx!netnews.upenn.edu!vax1.cc.lehigh.edu!sei.cmu.edu!krvw
From: Alan_J_Roberts@cup.portal.com
Newsgroups: comp.virus
Subject: Update on AIDS Trojan (PC)
Message-ID: <0008.8912131244.AA23196@ge.sei.cmu.edu>
Date: 13 Dec 89 02:17:04 GMT
Sender: Virus Discussion List <VIRUS-L@IBM1.CC.Lehigh.EDU>
Lines: 18
Approved: krvw@sei.cmu.edu

The following is a posting from John McAfee:

	Early reports from people who have disassembled the AIDS
trojan that has been mailed to numerous European corporations indicate
that the trojan may be encrypting information on the disk rather than
destroying it outright.  The results are the same without a decrypting
routine but the possibility is] now raised that the perpetrators do
have and may offer such a decryptor.  The report from Chase Manhattan
Bank that the name and address in the Trojan are bogus may not be
correct.  John Markoff of the New York Times has since stated that his
sources found a real corporation corresponding to the name and address
in the file.  This raises some interesting questions which, I believe,
only time will answer.  Whatever is happening, this much is known: The
trojan will make all data on the hard disk unusable; the change
happens suddenly; and no recovery is yet known.  If you find or have a
copy of this diskette don't use it.

John McAfee