ProfitPress Mega CDROM2 …eeware (MSDOS)(1992)(Eng)/ProfitPress-MegaCDROM2.B6I/UTILITY/VIRUS/PCV4RPT.ZIP/PLASTIQ.RPT

Text File | 1991-05-28 | 8.8 KB | 206 lines

             *********************************************
             ***   Reports collected and collated by   ***
             ***            PC-Virus Index             ***
             ***      with full acknowledgements       ***
             ***            to the authors             ***
             *********************************************


  Reports on PLASTQUE viruses
  ---------------------------

  Date:    19 Oct 90 14:20:30 -0400
  From:    "David.M.Chess" <[e-mail]>
  Subject: Plastique/Anti-CAD viruses (PC)

  There are now four known viruses in this series; all are based
  heavily on the JV, with the addition of a timer-interrupt handler
  that plays music periodically, some routines to make the occasional
  disk-write fail, and (in the later ones) code to infect boot records
  as well as executables; the later two (I think) also infect on OPENs
  of files called EXE or COM, as well as on executions.  Most or all
  of them also react in various ways to attempts to execute any
  program called ACAD.EXE (is that familiar to everyone?).  Each one
  contains a string (stored garbled in all but the first, earliest
  virus).  I give the strings in clear (and slightly reformatted)
  below.  Does anyone know where Fen Chia U.  is?  (I've also removed
  the vowel from the leading obscenity in the first message...)

  DC

  >From the one just discovered at Western Michigan U:

  > Sh*t!  As you can see this document, you may know what this
  > program is.  But I must tell you:  DO NOT TRY to WRITE ANY
    ANTI-PROGRAM
  > to THIS VIRUS.This is a test-program, the real dangerous code will
  > implement on November.  I use MASM to generate varius virus
  > easily and you must use DEBUG aginst my virus hardly, that is
  > foolish.  Save your time until next month.  OK?  Your Sincerely,
    ABT
  > Group., Oct 13th, 1989 at FCU.


  > From the "Plastique 4.51":
  > Program:  Plastique 4.51 (plastic bomb),
  > Copyright (C) 1988, 1989 by ABT Group.
  > Thanks to:  Mr.  Lin (IECS 762??),
  > Mr.  Cheng (FCU Inf-Center)


  >From the "Plastique 5.21":
  > PLASTIQUE 5.21 (plastic bomb)
  > Copyright (C) 1988-1990 by ABT Group
  > (in association with Hammer LAB.)
  > WARNING: DON'T RUN ACAD.EXE!


  >From the "Invader":
  > by Invader, Feng Chia U.,
  > Warning: Don't run ACAD.EXE!

==============================   MORE   ==================

  Date:    Fri, 07 Dec 90 18:37:59 -0500
  From:    Bob McCabe <[e-mail]>
  Subject: New Virus? (The Invader?) (PC)

  I got word today of a possible new virus that was apparently
  deliberaty spread around at the Canadian Computer Show.  As I have
  not heard or seen any postings of a simular virus I thought I'd post
  a description here to see if anyone knows anything about it.

  The virus apparently infects (Ed: NO!  No virus can infect the CMOS;
  only alter it) the CMOS on an AT, changing the drive type after an
  incubation period, and the locking out the hard drive.  It can be
  spread by running a program from an infected disk (how disks are
  infected is unknown, nor is it know if a particular program is the
  source).

  According to one distributor that got hit, the only way to remove
  the virus is to disconect the AT board from the battery backup and
  to wipe the BIOS on the hard disk controler.  (Ed: NO! Simply reset
  the CMOS) This may be a little extreme, but I have yet to see an
  infected machine.

  Apparently there is also a message displayed when the virus becomes
  active, calling the virus 'THE INVADER'.

  Does this sound simular to any know virus? Does SCAN pickup the
  virus, and if so which version?  Is there a simpler way to remove
  the virus from an infected machine?  Any help would be appreciated.
  I should get a copy of an infected disk on monday and may have more
  information then.

======================================================================
INET       : [e-mail]            Bob McCabe
CoSy       : bmccabe                            Psycholgy Dept.,
Compuserv  : 72260,1501                         University of Guelph
Phone      : [phone]                     Guelph,
                                                Ont. Canada
======================================================================

            ++++++  more  +++++

  Report from Jim Bates - The Virus Information Service - 4th January
  1991

  === Plastique Virus ===

  The Plastique Virus is Parasitic on COM and EXE files but excludes
  COMMAND.COM.  The infection method is slightly unusual in that COM
  files have the virus code prepended to the file, while EXE files
  have it appended.  In either case, the infective length is 2900
  bytes and no stealth capabilities exist to mask this increase in
  file length.  After infection, file attributes and date/time
  settings are restored to their original values.  The virus code is
  partially encrypted but allows the extraction of a recognition
  string.

  This virus becomes resident in high memory by using the DOS
  Terminate and Stay Resident function 31H.  During installation a
  timing routine determines the processing speed and this is used for
  sound effects later.

  As it becomes resident, INT 21H is intercepted by a special handler
  which will cause file infection on function requests 4B00H and
  3D00H, these correspond to Load and Execute, and Open file for Read
  Only.  The DOS Critical Error handler (INT 24H) is bypassed during
  the infection cycle to avoid error messages.

  On a random basis, virus installation after 20th Sept 1990 may cause
  other handlers to be installed which will produce certain sound
  effects and may result in execution of the trigger routine.  These
  handlers are as follows :- One of two INT 08 - Timer Interrupt
  handlers are installed (chances are even of either one being
  installed).

  Handler 1 increments a timer counter and slows processing
  progressively up to a limit decided during installation timing.

  Handler 2 also increments the timer counter and makes "explosion"
  noise about every 4.5 minutes

  An INT 09 - Keyboard Interrupt handler is installed which will
  intercept a Ctrl-Alt-Del key sequence and then act accordng to which
  INT 08 handler is installed.  If Handler 1 is present then the
  trigger routine is activated.  If Handler 2 is present then
  Non-volatile RAM is overwritten with 0FFH bytes.  The INT 09 handler
  also counts keypresses and after 4000 keypresses, an error will be
  forced on the next disk write request to INT 13H

  An INT 13H - Disk Access handler is installed which intercepts write
  requests and forces an error according to the condition of a flag.
  The error consists of putting -1 into DX (Head and Drive) and
  completing the call.  The routine then returns without setting the
  relevant flags so that the caller is not aware that his data has NOT
  been written.

  The Trigger routine occurs immediately on execution of ACAD.EXE,
  otherwise during a Ctrl-Alt-Del sequence from within INT09 handler
  if INT08 Handler 1 is installed and the timer counter has reached a
  predetermined limit.  The actual routine checks if there is a floppy
  disk in drive A:, if so it overwrites head 0 of all tracks with the
  contents of memory from address 0000:0000.  Processing continues
  similarly for floppy in drive B:, zapping it if possible.  Then the
  "explosion" routine is set to occur as both the first and second
  fixed disk drives are overwritten on all heads and tracks.  Finally
  a loop overwrites the contents of CMOS by direct port access.

  The virus recognises itself in memory by issuing an INT 21H with
  4B40H in the AX register.  If the virus is resident, the call
  returns with 5678H in AX.  Recognition on disk is by examining the
  word at offset 12H in the target file.  If this word is 1989H then
  the file is assumed to be infected.

  The recognition string for the Plastique virus is as follows :-

         B840 4BCD 213D 7856 7512 B841 4BBF 0001

  and this will be found at offset 82CH into the virus code.

  VIS Classification - CEOARK2900A


  The information contained in this report is the direct result of
  disassembling and analysing a specimen of the virus code.  I take
  great pains to ensure the accuracy of these analyses but I cannot
  accept responsibility for any loss or damage suffered as a result of
  any errors or omissions.  If any errors of fact are noted, please
  let me know at :-

    The Virus Information Service,
    Treble Clef House,
    64, Welford Road,
    WIGSTON MAGNA,
    Leicester  LE8 1SL

  or call [phone]

  Jim Bates

  ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
  ++++++++++++++++++++++++++ end of reports ++++++++++++++++++++++++
  ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++