> ## Content Index > Fetch the complete content index at: https://www.cowsayso.com/llms.txt > Use this file to discover other available public pages before exploring further. # The floppy that held you hostage: the AIDS disk, the first ransomware - URL: https://www.cowsayso.com/aids-disk-first-ransomware/ - Published: 2025-09-28T07:00:00.000Z - Updated: 2026-11-08T21:27:32.000Z - Description: December 1989: thousands of free floppy disks about AIDS arrive in the post. Ninety reboots later, your computer asks for $189 to be sent to Panama. The story of the first known ransomware, and of a very unwise suitcase. - Author: Vittorio Scala - Tags: Security, #skimmed December 1989\. A parcel arrives at the office: a floppy disk labelled *“AIDS Information – Introductory Diskette”*. Free, unsolicited, about the most serious health topic of the decade, with an interactive questionnaire to assess your risk. What could possibly go wrong? Everything. That floppy was the first known ransomware in history. Get comfortable: this is the story of a computer held hostage by a program that had warned you, in writing, and of the strangest airport luggage check in the history of cybercrime. ## The parcel According to *Virus Bulletin*, the specialist magazine that analysed the case in January 1990, several thousand disks were posted from London between 8 and 12 December 1989 (later accounts put the total at around 20,000). They went to computer users across the UK, Europe, Africa, Scandinavia and Australia. The recipients weren’t random. In the UK the disks were sent to the subscriber list of *PC Business World* magazine, a list that, in the magazine’s words, “had been obtained by deception”. Delegates to a world congress on AIDS held in Stockholm were targeted too, and so were subscribers to French and Italian business magazines. 🐄 Inserting a floppy disk that arrived by post from someone you don’t know. **Wrong.** In 1989 as today, unsolicited software is a stranger knocking at the door. You don’t let him in just because he’s brought a questionnaire. ## The fine print The best part: the disk came with a leaflet, and the leaflet warned you. It said the software would “adversely affect other program applications” and that you would owe compensation to a company called PC Cyborg Corporation. The threat was in the licence agreement. Literally. 🐄 Reading the licence agreement before installing? **It depends.** Usually it’s boring. Here it said, in black and white, that the program would wreck your computer. Nobody read it. Nobody ever does. ## Ninety reboots The disk contained two programs written in QuickBASIC 3.0\. The questionnaire, `AIDS.EXE`, was harmless. The installer, `INSTALL.EXE`, was not. It created a series of hidden directories whose names used ASCII character 255, which looks like a blank space on screen, and quietly replaced `AUTOEXEC.BAT`, the file DOS runs at every startup: ```bat echo off C: cd\  rem  PLEASE USE THE auto.bat FILE INSTEAD OF autoexec.bat FOR CONVENIENCE auto.bat ``` That `rem` looks like a harmless comment, but the invisible character after it turns it into the name of a program: the trojan itself. From then on, every time you turned the computer on, it added one to a counter. Nothing else happened. Everything worked. For about ninety reboots. Then the trap closed. The program hid all the directories on drive C:, scrambled the names of most of the files and filled the remaining free space. After that it pretended to be DOS: you typed commands, it answered like DOS, but it was still in charge. Among the files listed was a `READ.ME` that didn’t really exist: ```text C:\> TYPE READ.ME You are advised to stop using this computer. The software lease has expired. Important: Renew the software lease before you use this computer again. ``` And to pay? You were told to turn on the printer, which printed an invoice: a lease of $189, or a full licence for $378, to be sent to PC Cyborg Corporation at a post office box in Panama. 🐄 The cow says: it scrambled file names but never touched what was inside the files. A ransomware that couldn’t really hold anything to ransom. Very 1989. ## The antidote, for free In the UK, *PC Business World* immediately called Jim Bates, an analyst who took the program apart line by line. He produced a removal tool, AIDSOUT, and a recovery tool, CLEARAID, which restored the scrambled names. His verdict in *Virus Bulletin* is still the best review of the whole affair: *“While the conception is ingenious and extremely devious, the actual programming is quite untidy.”* The same issue noted that ordinary antivirus programs hadn’t noticed a thing: only checksumming programs, which detect when a file changes, had spotted the tampered `AUTOEXEC.BAT`. 🐄 Analysing the malware and giving the cure away for free. **Right.** The cow bows to Jim Bates, and she doesn’t bow to many. 🐄 Wiping your hard disk in a panic without a backup. **Wrong.** Some victims did exactly that, and press reports said an Italian AIDS organisation lost ten years of research data. Keep backups. Test them. Moo. ## The suitcase at Schiphol The author was Dr Joseph Popp, an American evolutionary biologist. A few weeks after the mailing he was flying back from a WHO seminar in Nairobi when, at Amsterdam’s Schiphol airport, he wrote “DR. POPP HAS BEEN POISONED” on another passenger’s suitcase. The resulting search of his luggage turned up links to PC Cyborg. The FBI arrested him in the United States and he was extradited to Britain, charged with blackmail and criminal damage. His lawyers said the money would go to alternative AIDS education programmes. The trial never happened: in November 1991 Judge Geoffrey Rivlin ruled that Popp was unfit to stand trial, and he was sent back to the United States. There he went back to evolutionary science, published a book called *Popular Evolution*, and a butterfly conservatory in upstate New York bears his name. 🐄 Writing your own name on a stranger’s suitcase at an international airport while you have something to hide. **Wrong.** Operational security, 1989 edition. ## First ransomware, not first trojan The AIDS disk is often called “the first trojan”, but that title belongs to someone else. In the mid-1970s John Walker wrote ANIMAL, a guessing game that quietly copied itself into every directory it could reach. It harmed no one. The AIDS disk is something else: the first known *ransomware*, a program that takes your data hostage and asks for money. Its fatal weakness was cryptographic. The key to undo the damage was inside the program itself, so anyone who analysed it could build the antidote, and that’s exactly what happened. In 1996 the cryptographers Adam Young and Moti Yung showed how public-key cryptography would remove that weakness, and they gave the field a name: cryptovirology. Modern ransomware took the advice. Unfortunately. 🐄 Was the AIDS disk the first trojan ever? **It depends.** On what you call a trojan: if it’s a program pretending to be something else, no, ANIMAL came first. If you mean the first one that asks for a ransom, yes, and that’s the title it deserves. 🐄 Moral: don’t run software that arrives uninvited, read what you’re agreeing to, keep backups you’ve actually tested, and if you’re up to no good, don’t sign your name on other people’s luggage. The cow has spoken, and the cow is law. Moo. 🐄 Sources - [Virus Bulletin, January 1990: editorial and Jim Bates, “Trojan Horse: AIDS Information Introductory Diskette Version 2.0”](https://www.virusbulletin.com/uploads/pdf/magazine/1990/199001.pdf?ref=cowsayso.com) - [Police CyberAlarm (UK), “The curious case of the first reported ransomware”](https://www.cyberalarm.police.uk/blog/the-curious-case-of-the-first-reported-ransomware?ref=cowsayso.com) - [Wikipedia, “AIDS (Trojan horse)”](https://en.wikipedia.org/wiki/AIDS%5F%28Trojan%5Fhorse%29?ref=cowsayso.com) - [John Walker, “The Animal Episode”](https://fourmilab.ch/documents/univac/animal.html?ref=cowsayso.com)