[comp.sys.ibm.pc] AIDS PC Virus

eickmeye@girtab.usc.edu (Biff Henderson) (12/16/89)

The following article is from the Los Angeles Times, Friday, 
December 15, 1989, page D3.

AIDS Data Disk Has PC-Damaging Virus

by Michael Specter
The Washington Post

     A mysterious computer diskette about AIDS that was mailed to 
major corporations, insurance companies and health professionals 
across the world contains a hidden program that has destroyed 
information in thousands of personal and corporate computers, 
police in London said Thursday.

     Officials of Scotland Yard said at least 10,000 copies of an 
unusual "AIDS Information Diskette," which promised to help users 
deduce their risk of becoming infected with the AIDS virus, were 
sent to people in England, Scandinavia, Africa and the United 
States.

     Hospital systems from London to Stockholm reported damage 
Thursday and AIDS researchers at major institutions in the United 
States, from the National Institutes of Health to the University 
of California at San Francisco, issued alerts to all their 
computer users.

     "Extremely urgent message for all National Institute of 
Allergy and Infectious Disease PC Users," said a flyer sent 
Thursday to AIDS researchers at NIH.  "A diskette from PC Cyborg 
Corp. contains a highly destructive virus.  All systems running 
these programs had ALL hard disk data DESTROYED."  Neither that 
corporation nor Ketema Associates, its parent company, has any 
known officers or location, according to people who tried 
Thursday to find them.

     In Sweden, the State Bacteriological Laboratory sent letters 
to clinics and doctors warning them of the diskette.  Chase 
Manhattan Bank was one of the first companies to report problems 
with the diskette, which also was sent to the London Stock 
Exchange, British Telecommunications, Lloyds Bank, the Midland 
Bank, other major banks and manufacturing companies.

     "We have never seen anything approaching the magnitude of 
this attack," sand John McAfee, chairman of the Computer Virus 
Industry Assn., though he noted no damage had yet been reported 
in the United States.  "It took enormous preparation, 
coordination and a huge amount of money."

     People familiar with computer "viruses" and other computer 
"diseases" were baffled by the maliciousness of the crime, the 
amount of money and sophistication it required and its lack of 
any immediately discernible motive.

     Computer programs written as pranks or tools of minor 
sabotage have become ubiquitous over the past few years.  But
this one was different, according to experts across the country.

     The diskette came in a slick package mailed from offices on 
London's tony New Bond Street.  The bright blue cover sheet said 
the package contained AIDS information, and informed recipients 
that the information was easy to use and would help them 
calculate the risks of exposure to the disease.

slimer@trsvax.UUCP (12/19/89)

  I think this is a travesty on the world public. To realize that someone
  will use such an obscure way to destroy thousands of peoples work is a
  frightening thing. Where will this all stop? When the juveniles grow-up?
  No! They just play harder. How can we stop these bogus mailers?

  My question to the net is... Is it possible to back-track the mailing
  process. I once heard from a postal employee that if you had the post
  mark stamp you could at least track it down to the nearest major post
  office. I know that I look at this stamp to determine where mail is from
  when it has no return label. So then couldn't you at least notify the
  postmaster in this office to watch for any mail under this phony name?

  Is this not a federal offense? To use the mail as a means to propogate
  crime would certainly seem such. I know that I am concerned with this
  new style of virus attacking. I receive many diskettes a month for
  promotion and demo purposes. Am I now going to have to use a totally
  empty machine each time I receive a new program?

  Any ideas?


****************************************************************************
*  Thank You,                                        texbell!rwsys!slimer  *
*         Bill                         "The Shadow Nodes" - ComputerWorld  *
*  George W. Pogue, 1300 Two Tandy, Fort Worth, TX. 76102  (817) 390-2871  *
****************************************************************************

poffen@molehill (Russ Poffenberger) (12/21/89)

In article <216100170@trsvax> slimer@trsvax.UUCP writes:
>
>
>  I think this is a travesty on the world public. To realize that someone
>  will use such an obscure way to destroy thousands of peoples work is a
>  frightening thing. Where will this all stop? When the juveniles grow-up?
>  No! They just play harder. How can we stop these bogus mailers?
>
[stuff deleted]
>  Is this not a federal offense? To use the mail as a means to propogate
>  crime would certainly seem such. I know that I am concerned with this
>  new style of virus attacking. I receive many diskettes a month for
>  promotion and demo purposes. Am I now going to have to use a totally
>  empty machine each time I receive a new program?
>
>  Any ideas?
>
>

No instance of this mailing has appeared in the U.S. It seemed to be limited
to the UK. Whether or not they have similar laws regarding use of mail is
something that possibly someone else can answer.

Russ Poffenberger               DOMAIN: poffen@sj.ate.slb.com
Schlumberger Technologies       UUCP:   {uunet,decwrl,amdahl}!sjsca4!poffen
1601 Technology Drive		CIS:	72401,276
San Jose, Ca. 95110
(408)437-5254

immisch@nbivax.nbi.dk (12/21/89)

In article <1989Dec21.000327.25605@sj.ate.slb.com>, poffen@molehill (Russ Poffenberger) writes:

> No instance of this mailing has appeared in the U.S. It seemed to be limited
> to the UK. 

According to the newpapers here, a pakistani businessman is now wanted for investigations. 
He has payed for a mailinglist, with all the names of people who attended a conference
about AIDS. Since this was an international meeting, the discs are sent to a number
of countries.

Torben Immisch@nbivax.nbi.dk

akcs.amparsonjr@vpnet.UUCP (Anthony M. Parson, Jr.) (01/03/90)

It wouldn't be a federal offense if it happened in a foreign country.  My
personal opinion, is that if 10,000 copies (more or less) were sent out
with slick binding, cover sheets, etc, then it is more than a prank.  It
would be very expensive, not likely done by teenagers with free computer time
on their hands.  (Well, the hacking could have been, but not the publishing
and mailing, documentation preparation, etc).  Why would someone do something
on such a large scale?  To get their name in the paper? Terrorists who don't
want to kill people?  Very strange situation.  On the other hand, has any
one actually seen one of these disk packages, or is this a story that may
be a hoax perpetrated on the media-viewing public??????
I still like to read about the latest Elvis sightings, and the flying
saucers that landed in Uraguay in such tabloids as the Inquirer and Star....

emmo@moncam.co.uk (Dave Emmerson) (01/11/90)

In article <25a10a71:3590.4comp.sys.ibm.pc;1@vpnet.UUCP>, akcs.amparsonjr@vpnet.UUCP (Anthony M. Parson, Jr.) writes:
> [deleted]
> and mailing, documentation preparation, etc).  Why would someone do something
> on such a large scale?  To get their name in the paper? Terrorists who don't
> want to kill people?  Very strange situation.  On the other hand, has any

I dunno what you'd call it elsewhere, but over here the term that comes
to mind is 'queer-bashing'
Think about it, all the intended victims attended an AIDS conference, that's
where the postal list is said to originate.
Personally I'd look for a successful male, mid-twenties..early thirties,
straight hetero, either just got it, or just lost someone close from it.
Whether his aim was accurate is another matter entirely. Anybody notice
any females mentioned in the hit list? Is this the place to discuss it?
Comment all you like, I don't intend to follow this thread any further.

Sherlock E.

jcsewell@disk.UUCP (Jim Sewell) (01/13/90)

In article <358@marvin.moncam.co.uk> emmo@moncam.co.uk (Dave Emmerson) writes:
>In article <25a10a71:3590.4comp.sys.ibm.pc;1@vpnet.UUCP>, akcs.amparsonjr@vpnet.UUCP (Anthony M. Parson, Jr.) writes:
>> [deleted]
>> and mailing, documentation preparation, etc).  Why would someone do something
>> on such a large scale?  To get their name in the paper? Terrorists who don't
>> want to kill people?  Very strange situation.  On the other hand, has any
>
>I dunno what you'd call it elsewhere, but over here the term that comes
>to mind is 'queer-bashing'
>Think about it, all the intended victims attended an AIDS conference, that's
>where the postal list is said to originate.

But you have overlooked one key issue.  The people at an AIDS conference may
not be there because they are in a high risk category.  Actually, I suppose
there would be more people at an AIDS conference that say "Gee, I'm a doctor
and I wonder if I touch a tongue depressor used on an AIDS ridden patient, 
will I get AIDS?" than would say "Yeah, I am a practicing homosexual who is
worried about getting a disease."  In fact I doubt if the stereotypical AIDS
carrier/victim(?) {male homosexual with 100's of sex partners} even CARES 
about how high of a risk he is of getting AIDS.  Of course, how many AIDS 
patients are stereotypical?

DISCLAIMER:  I have tried to place none of my personal opinions about the
morality of homosexuality in this posting.  If you want my opinion you can
ask via mail.  You don't?  Nah, I didn't think so.  I also am aware that the
program is supposedly to ask questions as if you are at risk of getting AIDS
via sexual/drug practices, etc.  Flames to this acct via email if you must,
or if you want public observance of YOUR opinions followup to 
misc.newsgroup.aids   (whatever is the one most appropriate).

-- 
============================================================================
J.C. Sewell		DISK: Digital Information Systems of Kentucky
jcsewell@disk		(502) 968-5401 thru 968-5406  
"No one can make you feel inferior without your consent" - Elanore Roosevelt