Virus Database

DSME-based Viruses

Description DSME-based Viruses

DSME (Dark Slayer's Mutating Engine) is a polymorphic generator like the MtE or TPE generators. It creates the decryption routine and encrypts the virus body, then the virus saves this part of code in file on infection. This generator contains the internal string: "DSME v1.0".
DSME.Apex
It's a not dangerous not memory resident parasitic virus. It searches for .COM-files and writes itself to their ends. In September it manifests itself with sound and video effects. Tt displays the text string:
My name is APEX v1.0_ Congratulations! PS:I wouldn't hurt your data.Be relax!.Ha

DSME.Connie
These are harmless memory resident parasitic polymorphic viruses. They are not linked with DSME generator but they contain DSME related polymorphic code. They look like "rough copies" of DSME generator.
These viruses hook INT 21h and write themselves at the end of COM-files are accessed. They contain the internal text strings "C:COMMAND.COM" and:
"DSME.Connie.1746": This is
Written by Dark Slayer in Keelung TAIWAN
"DSME.Connie.2708": This is Connie v2.0
Written by Dark Slayer in Keelung, Taiwan

DSME.DemoVirus
It's a harmless not memory resident parasitic DSME-based virus. It searches for .COM-files and writes itself to their ends. It contains the internal text:
This is a DemoVirus for DSME v1.0, Written by Dark Slayer in Keelung,Taiwan

DSME.Teacher
It's a harmless memory resident parasitic DSME-based virus. It hooks INT 21h and writes itself to the end of COM- and EXE-files that are executed. It contains the internal text string:
Teacher virus ( A demo virus for DSME to all teacher )

Check other viruses! Be aware! Use Antiviral Software

Macro.Word97.Komcon

Description Macro.Word97.Komcon

The virus for Word 97 contains 2 macros in 2 modules, both modules and macros have the same names. This virus was converted from its Word6/7 prototype, and as well as original virus it infects the global macros area (NORMAL.DOT) on AutoOpen call and writes itself to the documents on AutoClose call. The virus does not a manifest itself in any way.

Macro.Word97.Lafs

Description Macro.Word97.Lafs

The virus code contains six macros in one module: AutoOpen, AutoClose, ToolMacro, ViewVBCode, FileTemplates, exec. In templates module name is "lafs", in documents - "dd".
The virus replicates on opening and closing documents. While infecting it disables VirusProtection option. On closing documents the virus displays its own FileSaveAs dialog.
On June'14 the virus displays the assistant balloon:
Happy Birthday
Selamat Ulang Tahun sayang semoga panjang umur dan tuhan menyertaimu.

On November'6 inserts into documents the lines:
Love at First Sight
Patas AC 19
6 November 1997

Home