DSME Virus

Virus Name: DSME Aliases: DSME.Teacher V Status: New Discovered: August, 1994 Symptoms: .COM & .EXE growth; TSR Origin: Unknown Eff Length: 3,278 - 3,519 Bytes (Approx) Type Code: PRsAK - Parasitic Resident .COM & .EXE Infector Detection Method: AVTK, Sweep, F-Prot, IBMAV, NAV, NAVDX, VAlert, PCScan, ViruScan 2.51+, AVTK/N, Sweep/N, IBMAV/N, NShld, NAV/N Removal Instructions: Delete infected files General Comments: The DSME or DSME.Teacher virus was submitted in August, 1994. It is a polymorphic, memory resident infector of .COM and .EXE programs, including COMMAND.COM. Its origin or point of isolation is unknown. When the first DSME infected program is executed, this virus will install itself memory resident as a low system memory TSR of 9,008 bytes, hooking interrupt 21. Once resident, DSME will infect .COM and .EXE programs when they are executed. Infected programs will increase in size by approximately 3,278 to 3,519 bytes with the virus being located at the end of the file. The program's date and time in the DOS disk directory listing will not be altered. The following text strings are encrypted within the viral code: "Teacher virus ( A demo virus for DSME to all teacher )" "DSME v1.0" DSME doesn't appear to do anything besides replicate.