[comp.virus] AIDS TROJAN STAGE 2 UPDATE

IA96@PACE.BITNET (IA96000) (12/19/89)

Forgot to mention this in yesterday's update. Sorry about that!

PKSCRYPT.EXE is a fine shareware program designed by Lloyd Miller in
Canada, a year or two ago. It is a public key encryption program
and can be used (at least SWE used it) to decrypt files encrypted by
the AIDS trojan. It is available on many BBS's and Lloyd runs a FIDO
BBS in Canada.It is available at (201) 249-1898 as CRYPT.ZIP

Start off using 13 digit (numbers not characters) decryption keys.
Three of the digits will be the major and minor numbers of your DOS
version. For example DOS 4.01 would be 401, etc; Two of the digits will
be the last two digits in the length of command.com if it was on the
disk when stage two was triggered.

It is not yet known what is used for these two digits if command.com
was not present.

Hope this helps somewhat!