Virus.DOS.Lokjaw.Kenson is a dangerous memory resident file companion virus on DOS.

There are 2 variants:

  • Virus.DOS.Lokjaw.Kenson.573
  • Virus.DOS.Lokjaw.Kenson.887


When the virus is loaded into memory, it looks for any EXE executable that is run, and then it places a DOS executable having the same name by copying itself into it. No files will be infected.

Due to priority of running executables on MS-DOS, when the user runs the same program again, the virus will run first.

Advanced details

The following table shows the memory usage of the variants.

Variant Memory usage in bytes
Lokjaw.Kenson.573 4,096
Lokjaw.Kenson.887 4,096

MD5 hashes:

Variant Hash
Lokjaw.Kenson.573 68291ebc8dcdc0221d6a80deb6dad2ce
Lokjaw.Kenson.887 7135153714684a446c46837919963169


The virus triggers when the user attempts to run the antivirus program MSAV or MWAV.


This variant crashes the system by accessing an invalid part of memory when MSAV or MWAV is run, and no companion files will be added.


When MSAV or MWAV is run, instead of placing companion files, the virus deletes the program and turns the screen black, followed by hanging the system. A hard reset must be taken after this.

Other details

Lokjaw.Kenson.573 contains the internal text strings:

[ Its the  KenSON III  virus ]
For My Very Best Friend
...By Lobo 435 of Covina CA...

Lokjaw.Kenson.887 contains the internal text strings:

KenSON V - Lobo/435  BF!  :)
For My Best Friend, the Fifth in a Series!!!

See also