Fandom

Malware Wiki

Leo

1,321pages on
this wiki
Add New Page
Comments0 Share

Virus.DOS.Leo or Leo is a parasitic virus that runs on MS-DOS.

There are 9 variants in 5 versions, represented by the following:

  • Virus.DOS.Leo.293
  • Virus.DOS.Leo.301
  • Virus.DOS.Leo.333
  • VIrus.DOS.Leo.1965
  • Virus.DOS.Leo.3948

BehaviorEdit

Except Leo.293, these variants might not infect a file on every run, and the timestamp of the infected files would be changed to the time of infection.

Leo.293Edit

When the virus is run, it infects every DOS executable in current directory.

Files infected by this variant may experience abnormal program runtime.

Leo.301, 328, 331 and 332Edit

These variants infect one DOS executable on each run.

Programs infected by Leo.301 or 332 may become malfunctioned and could not run properly.

Leo.333Edit

This variant is the only version that infects EXE files. It targets files used by Windows, infects one file by overwriting the beginning of the file on each run. No file size change can be observed, but the timestamp.

Leo.1965, 3948 and 3949Edit

These variants infect one DOS executable on each run. When a directory contains only goat files and the virus, running the virus may hang the system.

The virus does not infect files in C:\DOS, meaning that if the virus is located in this directory, running it would do nothing to the files.

Some files infected by Leo.1965 may become malfunctioned.

PayloadEdit

Leo.293, 301, 328, 331, 332 and 333Edit

These variants do not manifest themselves at anyway.

Leo.1965Edit

This variant deactivates on April 13th, on this day the virus does not spread out (i.e. no new infections).

Leo.3948 and 3949Edit

When an infected program is run on December 31st, the virus displays the ASCII text with some green asterisks:

THE LEO

And also the message:

Hallo, I've got a virus for you..

Today is  the 31 of December, because I  want to
congratulate with a  Happy New Year...  Today is
a  holiday and I  want a pair of COM files... :)
You have a holiday and you'll have many presents
tommorow. I would like to join at this tradition
Could you take me a present as a file, please...
I'll be glad! Thank you for all, good bye..

Santa Leo...

And then it returns to DOS after a keypress.

VariantsEdit

This family has 9 variants in total:

  • Virus.DOS.Leo.293
  • Virus.DOS.Leo.301
  • Virus.DOS.Leo.328
  • Virus.DOS.Leo.331
  • Virus.DOS.Leo.332
  • Virus.DOS.Leo.333
  • Virus.DOS.Leo.1965
  • Virus.DOS.Leo.3948
  • Virus.DOS.Leo.3949

Other detailsEdit

Leo.293 contains the internal text string:

- Virus "Leo", created in 1997 -

Leo.301 contains the internal text string:

*.com
Leo

Leo.328 and 331 contain the internal text string and 3 NOP opcodes:

*.com

Leo.332 contains the internal text string:

--== The Leo ==--

Leo.3948 and 3949 contain the internal text strings and the filename of the infected file:

LLEO3949.CO0
????????COM
COM
*.*
*.com

VideosEdit

Virus.DOS.Leo00:21

Virus.DOS.Leo.3948

Leo virus review by Alles Sandro

Leo DOS Virus00:21

Leo DOS Virus

Leo DOS Virus

Ad blocker interference detected!


Wikia is a free-to-use site that makes money from advertising. We have a modified experience for viewers using ad blockers

Wikia is not accessible if you’ve made further modifications. Remove the custom ad blocker rule(s) and the page will load as expected.