He decided to have a look at the hidden files, using another special program. This software went right into the heart of the files, penetrating the binary code, the building blocks of programs. It presented the contents on a vertically split screen: the left side displaying the files in computer code, the right in ordinary text. Jim went through them page by page. He discovered that the hidden files contained a counter, which kept track of the number of times the computer was turned on. After ninety start-ups the hidden files would spring to life and attack the computer's hard disk, encrypting working files and hiding programs. Without access to programs and data, the system would be unusable.
The diskette Jim realized, was a huge trojan horse, a malicious piece of software that entered a system in the guise of something useful, then unleashed its payload. In this case the "useful" component was the "AIDS information" file; the payload was the scrambling of the hard disk.
Curiously, Jim found that the program had been written to behave almost like the real AIDS virus. It was opportunistic, just like its biological counterpart; it spread its infection slowly; and was ultimately fatal to its hosts. Whoever wrote the program must have been casually interested in AIDS, though perhaps he didn't know a great deal about the subject. Switching to the AIDS information file, Jim read through the material it offered, which described itself as "An interactive program for health education on the disease called AIDS.... The health information provided could save your life.... Please share this program diskette with other people so that they can benefit from it too."
The program offered "up-to-date information about how you can reduce the risk of future infection, based on the details of your own lifestyle and history." It required a user to answer thirtyeight questions--sex, age, number of sexual partners since 1980, medical history, sexual behavior, and so on--and according to the user's answers it provided "confidential advice," most of which was eccentric and misleading: "Scientific studies show that you cannot catch AIDS from insects," and "AIDS can be prevented by avoiding the virus" were two of the less helpful comments. Others included, "Danger: Reduce the number of your sex partners now!" "You are advised that your risk of contracting AIDS is so large that it goes off the chart of probabilities." "Buy condoms today when you leave your office." "Insist that your sex partner be mutually faithful to the relationship." "Casual kissing appears to be safe. Open-mouth kissing appears to be more dangerous. It is that which follows open-mouth kissing that is most risky.'' "The AIDS virus may appear in small quantities in the tears of an infected person."
The AIDS trojan, as it had quickly become named, also produced a variety of messages demanding payment for the license. In certain cases, if the computer was linked to a printer, it could cause an invoice to be printed out. The money for the license was to be sent to PC Cyborg Corporation at a post office box in Panama City, Panama. It was not specified what users would receive for the fee, apart from a license. But it was assumed that an antidote for the trojan would be included in the deal.
The AIDS information diskette was the largest and most complex trojan Jim had ever seen. He worked on it eighteen hours a day for seventeen days and later said that taking the program apart was "like peeling an onion with a paper clip." His final disassembly ran to 383 pages, each containing 120 lines of code. He had managed to produce a quick antidote to the AIDS trojan on the day he received it, but after he had disassembled the bug, he put together a program called ClearAid which would restore files and cleanse infected systems.
The antidote and ClearAid were offered free to infected computer users by Jim and PC Business World.
Later, when the furor died down, Jim decided that the trojan had been written "by a young, inexperienced programmer with only scant knowledge of both the language and the machine capabilities at his disposal." Its tortuous complexity had been caused by incompetence rather than design.
