|Place of Origin||Sophia, Bulgaria|
|Infection Length||3,118 bytes|
When an infected file is executed, the virus will infect about 4 .com files in the current working directory. It does not attempt to avoid COMMAND.COM. The virus appends its code to the end of the file.
Most of the infections will be encrypted by the Dark Avenger Mutation Engine. Those that are not will have the visible text: "We dedicate this little virus to Sara Gordon who wanted to have a virus named after her.".
A second version of the virus was introduced some time in mid-1992. It adds the ability to become memory resident, just below the 640k DOS boundary. Infected files will have a length of 3,582 to 3,758 bytes longer than their original size, while it takes up 5,120 bytes in memory. Files are infected as they are executed. The file's date and time will not be altered. It also will occasionally produce an unencrypted copy, in which the following texts will be visible:
"We dedicate this little virus to Sara Gordon," "who wanted to have it corrected--" "learn to program before you touch M_t_e"
A third version was introduced later in the same year. It has most of the characteristics of version 2, but may also infect .exe files. It adds 3,539 to 3,717 bytes to an infected file.
Computer security researcher Sarah Gordon had a virus problem with the Pingpong virus on a computer she had recently purchased. She looked online for help and found the Fidonet Virus Echo. Gordon became intrigued by a poster named Dark Avenger and naively asked for him to name a virus after her. When she later learned more about viruses, Gordon regretted this.
Patricia Hoffman. DAME Virus.
Sarah Gordon. Virus News International, Inside the Mind of Dark Avenger. 1993