Virus.DOS.Leo is a parasitic virus on DOS.

There are 9 variants in 5 versions, represented by the following:

  • Virus.DOS.Leo.293
  • Virus.DOS.Leo.301
  • Virus.DOS.Leo.333
  • VIrus.DOS.Leo.1965
  • Virus.DOS.Leo.3948


Except Leo.293, these variants might not infect a file on every run, and the timestamp of the infected files would be changed to the time of infection.


When the virus is run, it infects every DOS executable in current directory.

Files infected by this variant may experience abnormal program runtime.

Leo.301, 328, 331 and 332Edit

These variants infect one DOS executable on each run.

Programs infected by Leo.301 or 332 may become malfunctioned and could not run properly.


This variant is the only version that infects EXE files. It targets files used by Windows, infects one file by overwriting the beginning of the file on each run. No file size change can be observed, but the timestamp.

Leo.1965, 3948 and 3949Edit

These variants infect one DOS executable on each run. When a directory contains only goat files and the virus, running the virus may hang the system.

The virus does not infect files in C:\DOS, meaning that if the virus is located in this directory, running it would do nothing to the files.

Some files infected by Leo.1965 may become malfunctioned.


Leo.293, 301, 328, 331, 332 and 333Edit

These variants do not manifest themselves at anyway.


This variant deactivates on April 13th, on this day the virus does not spread out (i.e. no new infections).

Leo.3948 and 3949Edit

When an infected program is run on December 31st, the virus displays the ASCII text with some green asterisks:


And also the message:

Hallo, I've got a virus for you..

Today is  the 31 of December, because I  want to
congratulate with a  Happy New Year...  Today is
a  holiday and I  want a pair of COM files... :)
You have a holiday and you'll have many presents
tommorow. I would like to join at this tradition
Could you take me a present as a file, please...
I'll be glad! Thank you for all, good bye..

Santa Leo...

And then it returns to DOS after a keypress.


This family has 9 variants in total:

  • Virus.DOS.Leo.293
  • Virus.DOS.Leo.301
  • Virus.DOS.Leo.328
  • Virus.DOS.Leo.331
  • Virus.DOS.Leo.332
  • Virus.DOS.Leo.333
  • Virus.DOS.Leo.1965
  • Virus.DOS.Leo.3948
  • Virus.DOS.Leo.3949

Other detailsEdit

Leo.293 contains the internal text string:

- Virus "Leo", created in 1997 -

Leo.301 contains the internal text string:


Leo.328 and 331 contain the internal text string and 3 NOP opcodes:


Leo.332 contains the internal text string:

--== The Leo ==--

Leo.3948 and 3949 contain the internal text strings and the filename of the infected file:



  1. List of variants of the Leo virus on VX Heaven




Leo virus review by Alles Sandro

Leo DOS Virus00:21

Leo DOS Virus

Leo DOS Virus

Ad blocker interference detected!

Wikia is a free-to-use site that makes money from advertising. We have a modified experience for viewers using ad blockers

Wikia is not accessible if you’ve made further modifications. Remove the custom ad blocker rule(s) and the page will load as expected.