Plastique-B Virus

Virus Name: Plastique-B Aliases: Plastic Bomb, Plastique 5.21, Plastique 2, Anticad 1 V Status: Rare Discovered: July, 1990 Symptoms: TSR; .COM & .EXE file growth; BSC; Origin: Taiwan Eff Length: 4,096 Bytes Type Code: PRsAB - Parasitic Resident .COM & .EXE, & Boot Sector Infector Detection Method: ViruScan, AVTK, F-Prot, NAV, Sweep, IBMAV, NAVDX, VAlert, PCScan, ChAV, NShld, LProt, Sweep/N, Innoc, NProt, AVTK/N, NAV/N, IBMAV/N Removal Instructions: Delete infected files General Comments: The Plastique-B, or Plastique 5.21, virus is a later version of the Plastique virus. Like Plastique, it is a memory resident generic infector of .COM and .EXE files. This version will also infect diskette boot sectors. It does not infect COMMAND.COM. If the system date is before September 20th, the first time a program infected with Plastique-B is executed, the virus will install itself memory resident as a TSR in low system memory. The TSR is 5,120 bytes in length. Interrupts 08, 09, 13, 21, and ED are hooked by the virus. If the system date is after September 20th, the virus will install itself memory resident in high system memory but below the 640K DOS boundary. The same interrupts will be hooked by the virus. After the virus is memory resident, it will attempt to infect any .COM or .EXE file which is executed or opened for any reason. It has had many of the "bugs" fixed that were in Plastique, and is usually successful in infecting files. Infected .COM and .EXE files will increase in length by 4,096 bytes. Plastique-B will also infect the boot sector of any diskettes accessed on an infected system. After September 20th, 1990, the Plastique-B virus activates. It will either progressively slowdown the system or cause "bomb" noises to be emitted periodically from the system speaker. It may also overwrite the contents of all drives after this date, depending on if a predetermined limit in the virus has been reached. See: Invader Plastique