Virus Name: DSME
V Status: New
Discovered: August, 1994
Symptoms: .COM & .EXE growth; TSR
Eff Length: 3,278 - 3,519 Bytes (Approx)
Type Code: PRsAK - Parasitic Resident .COM & .EXE Infector
Detection Method: AVTK, Sweep, F-Prot, IBMAV, NAV, NAVDX,
VAlert, PCScan, ViruScan 2.51+,
AVTK/N, Sweep/N, IBMAV/N, NShld, NAV/N
Removal Instructions: Delete infected files
The DSME or DSME.Teacher virus was submitted in August, 1994. It
is a polymorphic, memory resident infector of .COM and .EXE programs,
including COMMAND.COM. Its origin or point of isolation is unknown.
When the first DSME infected program is executed, this virus will
install itself memory resident as a low system memory TSR of 9,008
bytes, hooking interrupt 21.
Once resident, DSME will infect .COM and .EXE programs when they are
executed. Infected programs will increase in size by approximately
3,278 to 3,519 bytes with the virus being located at the end of the
file. The program's date and time in the DOS disk directory listing
will not be altered. The following text strings are encrypted within
the viral code:
"Teacher virus ( A demo virus for DSME to all teacher )"
DSME doesn't appear to do anything besides replicate.