PS-MPC2 Virus Generator (31-July-1993)
Entry...............: PS-MPC2 Virus Generator 
Alias(es)...........: PS-MPC G2 =
                      Phalcon-Skism G2 0.70 beta Virus Generator
Virus Strain........: Phalcon-Skism G2 generated Viruses (generates com-
                         pact easily modifiable commented source code)
Virus detected when.: 
              where.: 
Classification......: Virus-Generator: Creates Assembly Code for
                         Resident and Non-resident File Infectors,
                         optionally Self-encrypting. 
Length of Virus.....: Depends on creation options and action routine
--------------------- Preconditions ------------------------------------
Operating System(s).: MS-DOS
Version/Release.....: Versions 4.0 and upward
Computer model(s)...: IBM & compatibles
--------------------- Attributes ---------------------------------------
Easy Identification.: Variable self-identification         
Type of infection...: COM and EXE infector, appending
Infection trigger...: 1) Execution of an infected program.
                      2) Every INT 21 call in resident viruses. 
Storage media affected: EXE and or COM files infected;
                         COMMAND.COM may be infected (parameter)
Interrupts hooked...: INT 21 all functions, (INT 24)
Damage..............: To be written by specific virus author and to
                         be linked to PS-MPC G2 generated code.            
Damage Trigger......: Depending on specific virus.
Particularities.....: - PS-MPC G2 Viruses decrease memory in high 
                        memory-area if resident.
                      - The PS-MPC G2 generator offers the following
                           major Skeleton configuration options:
                           * Infection C(OM)/E(XE) (may be both)
                           * CommandCom (Yes/No): infect COMMAND.COM
                           * Resident (Yes/No)
                           * Encrypted (Yes/No), Encryption: xor, add 
                           * IDWord (2 character:self-identification)
                           * MinSize/MaxSize: minimum/maximum size 
                                of COM files to be infected
                           * Infections#: max.number of infections
                           * ErrorHandler: critical error handler for
                               Abort,Retry,Fail messages
                           * VirusName, AuthorName: strings
                           * AntiDebugger (Yes/No): If this option is 
                               set to Yes, the CPU-generated Breakpoint 
                               Interrupt INT3 points to INT21 and is
                               also used from the virus itself instead 
                               of INT21.
Similarities........: 1) PS-MPC (original version) 
                      2) Following PS MPC G2 generated viruses are 
                         known:
--------------------- Agents -------------------------------------------
Countermeasures.....: 
Countermeasures successful: FindViru, F-Prot (etc) detect PS MPC G2
                            generated viruses.
Standard means......:
--------------------- Acknowledgement ----------------------------------
Location............: University of Hamburg, Virus Test Center, Germany
Classification by...: Holger Prescher & Frank Bohnsack
Documentation by....: Holger Prescher & Frank Bohnsack
Date................: 31-July-1993
Information Source..: Reverse-Analysis of Generator, Skeleton files.

.