 Virus Name:  Plastique
 Aliases:     Plastic Bomb, Plastique 3012, Plastique 1, Anticad 3
 V Status:    Rare
 Discovered:  July, 1990
 Symptoms:    TSR; .COM & .EXE growth; possible system slowdown or bomb
              noises after September 20
 Origin:      Taiwan
 Eff Length:  3,012 Bytes
 Type Code:   PRsA - Parasitic Resident .COM & .EXE Infector
 Detection Method:  ViruScan, IBM Scan, AVTK, F-Prot, NAV, Novi, Sweep, VET,
                    CPAV, UTScan, VirexPC, VBuster, AllSafe, ViruSafe, VNet,
                    Gobbler2, Trend, Iris, Panda, Detect+, IBMAV, Vi-Spy,
                    NShld, LProt, CPAV/N, Sweep/N
 Removal Instructions:  CleanUp, or delete infected  files

 General Comments:
       The Plastique, or Plastic Bomb, virus was submitted in July 1990,
       it comes to us from Taiwan.  Plastique is a memory resident generic
       infector of .COM and .EXE files, though it does not infect
       COMMAND.COM.  Unlike the Plastique-B virus listed below, this
       virus does not infect floppy disk boot sectors.

       The first time a program infected with Plastique is executed, the
       virus will install itself memory resident as a TSR in low system
       memory.  The TSR is 3,264 bytes in length, and hooks interrupt 21.

       After the virus is memory resident, it will attempt to infect any
       .COM or .EXE file which is executed.  This virus is rather "buggy",
       and it is not always successful in infecting files when they are
       executed.  When it is successful infecting the file, the file's
       length will increase.  For infected .COM files, the length will
       increase by 3,012 bytes.  For infected .EXE files, their length
       will increase between 3, 012 and 3,020 bytes.

       Plastique will also attempt to infect files when they are opened
       for any reason, though again, it is not always successful.

       After September 20th of any year, the Plastique virus activates.
       At that time, it will do either of two things.  It will either
       progressively slowdown the system, or it will intermittently emit
       "bomb" noises from the system speaker.

       Known variant(s) of Plastique are:
       HM2: The earliest known version of this virus, it does not
            replicate.  Executing an infected file results in the system
            hanging requiring a reboot.
            Origin: Taiwan, May 1990.
       Plastique 4.21: A variant of the Plastique virus described above,
                       the only real difference is that the encryption of
                       the virus is slightly different.  Otherwise it
                       behaves exactly the same as Plastique.
                       Origin: Taiwan, July 1990.
       Plastique COBOL: A variant of the Plastique virus described above,
                        this version is 3,004 bytes in length, and its
                        memory resident TSR is 3,248 bytes in length.  The
                        only text character string which can be found in
                        this variant is "COBOL".  This string does not
                        occur in other variants of the Plastique virus, or
                        related viruses.  Infected .COM programs will
                        increase in size by 3,004 bytes, .EXE files by
                        3,004 to 3,019 bytes.  COMMAND.COM will not
                        become infected.  Activation of the virus has also
                        been altered.  Between January 1st and September
                        21st, the virus will progressively slowdown the
                        system.  After 20 minutes, the system will execute
                        at approximately 50% of its original speed.  After
                        30 minutes, the virus may lockout the system
                        keyboard, as well as corrupt the system's CMOS
                        configuration.  Between September 22nd and
                        December 31st, the virus does not activate, and no
                        system slowdown or CMOS corruption will occur.

       See:   Invader   Plastique-B   Tobacco

