Virus Name: Plastique-B
Aliases: Plastic Bomb, Plastique 5.21, Plastique 2, Anticad 1
V Status: Rare
Discovered: July, 1990
Symptoms: TSR; .COM & .EXE file growth; BSC;
Eff Length: 4,096 Bytes
Type Code: PRsAB - Parasitic Resident .COM & .EXE, & Boot Sector Infector
Detection Method: ViruScan, AVTK, F-Prot, NAV, Sweep, IBMAV,
NAVDX, VAlert, PCScan, ChAV,
NShld, LProt, Sweep/N, Innoc, NProt, AVTK/N,
Removal Instructions: Delete infected files
The Plastique-B, or Plastique 5.21, virus is a later version of the
Plastique virus. Like Plastique, it is a memory resident generic
infector of .COM and .EXE files. This version will also infect
diskette boot sectors. It does not infect COMMAND.COM.
If the system date is before September 20th, the first time a
program infected with Plastique-B is executed, the virus will
install itself memory resident as a TSR in low system memory. The
TSR is 5,120 bytes in length. Interrupts 08, 09, 13, 21, and ED
are hooked by the virus.
If the system date is after September 20th, the virus will install
itself memory resident in high system memory but below the 640K DOS
boundary. The same interrupts will be hooked by the virus.
After the virus is memory resident, it will attempt to infect any
.COM or .EXE file which is executed or opened for any reason. It
has had many of the "bugs" fixed that were in Plastique, and is
usually successful in infecting files. Infected .COM and .EXE
files will increase in length by 4,096 bytes.
Plastique-B will also infect the boot sector of any diskettes
accessed on an infected system.
After September 20th, 1990, the Plastique-B virus activates. It
will either progressively slowdown the system or cause "bomb"
noises to be emitted periodically from the system speaker. It may
also overwrite the contents of all drives after this date,
depending on if a predetermined limit in the virus has been reached.
See: Invader Plastique