AIDS is a DOS computer virus which overwrites COM files.

Description

AIDS is the first virus known to exploit the MS-DOS "corresponding file" vulnerability. In MS-DOS, if the user enters in the command interpreter, in a directory where both and exist, then will always be executed. Thus, by creating infected COM files, AIDS code will always be executed before the intended EXE file.

When the AIDS virus activates, it displays the following screen (bracketed comments not in original):

<blockquote>

</blockquote>

In the message above, the word "AIDS" covers about half of the screen. The system is then halted, and must be powered down and rebooted to restart it.

The AIDS virus overwrites the first 13,952 bytes of an infected COM file. Overwritten files must be deleted and replaced with clean copies in order to remove the virus. It is not possible to recover the overwritten portion of the program.

AIDS II

AIDS II is a companion computer virus, which infects COM files. First discovered in April 1990, it appears to be a more elegant revision of AIDS, which also employs the corresponding file technique to execute infected code.

<blockquote>

</blockquote>

References