Virus.DOS.Leo is a parasitic virus on DOS.

There are 9 variants in 5 versions, represented by the following:

  • Virus.DOS.Leo.293
  • Virus.DOS.Leo.301
  • Virus.DOS.Leo.333
  • VIrus.DOS.Leo.1965
  • Virus.DOS.Leo.3948


Except Leo.293, these variants might not infect a file on every run, and the timestamp of the infected files would be changed to the time of infection.


When the virus is run, it infects every DOS executable in current directory.

Files infected by this variant may experience abnormal program runtime.

Leo.301, 328, 331 and 332

These variants infect one DOS executable on each run.

Programs infected by Leo.301 or 332 may become malfunctioned and could not run properly.


This variant is the only version that infects EXE files. It targets files used by Windows, infects one file by overwriting the beginning of the file on each run. No file size change can be observed, but the timestamp.

Leo.1965, 3948 and 3949

These variants infect one DOS executable on each run. When a directory contains only goat files and the virus, running the virus may hang the system.

The virus does not infect files in C:\DOS, meaning that if the virus is located in this directory, running it would do nothing to the files.

Some files infected by Leo.1965 may become malfunctioned.

Advanced details

These virus are not memory resident.

MD5 hashes:

Variant Hash
Leo.293 9f24bb3d5def3b583d975104741a9d77
Leo.301 a90122830c48cd31f304dcf3d70aa801
Leo.328 95a9364b8b8ad0e1826e87fb976811df
Leo.331 40725d5548365c9de47fc8d5f2e8cd87
Leo.332 35b92ba5c4881c76672d8235881271db
Leo.333 73156ac004744f0a8a597c53e1833c84
Leo.1965 89e71a3d2f238d65040127edb6001ffd
Leo.3948 53c5ed2b60aa3f5eac72c0a5f470e211
Leo.3949 3ee1ebd621beda4c6c2a2c5d08a25206


Leo.293, 301, 328, 331, 332 and 333

These variants do not manifest themselves at anyway.


This variant deactivates on April 13th, on this day the virus does not spread out (i.e. no new infections).

Leo.3948 and 3949

When an infected program is run on December 31st, the virus displays the ASCII text with some green asterisks:


And also the message:

Hallo, I've got a virus for you..

Today is  the 31 of December, because I  want to
congratulate with a  Happy New Year...  Today is
a  holiday and I  want a pair of COM files... :)
You have a holiday and you'll have many presents
tommorow. I would like to join at this tradition
Could you take me a present as a file, please...
I'll be glad! Thank you for all, good bye..

Santa Leo...

And then it returns to DOS after a keypress.


This family has 9 variants in total:

  • Virus.DOS.Leo.293
  • Virus.DOS.Leo.301
  • Virus.DOS.Leo.328
  • Virus.DOS.Leo.331
  • Virus.DOS.Leo.332
  • Virus.DOS.Leo.333
  • Virus.DOS.Leo.1965
  • Virus.DOS.Leo.3948
  • Virus.DOS.Leo.3949

Other details

Leo.293 contains the internal text string:

- Virus "Leo", created in 1997 -

Leo.301 contains the internal text string:


Leo.328 and 331 contain the internal text string and 3 NOP opcodes:


Leo.332 contains the internal text string:

--== The Leo ==--

Leo.3948 and 3949 contain the internal text strings and the filename of the infected file:



  1. List of variants of the Leo virus on VX Heaven




Leo virus review by Alles Sandro

Leo DOS Virus

Leo DOS Virus

Leo DOS Virus